Method, System, and Computer Program Product for Aggregating Data from a Plurality of Sources

ABSTRACT

Provided is a method for aggregating data from a plurality of sources. The method may include receiving a request comprising aggregation of interest data associated with a type of aggregation of interest and set identification data associated with a set of data. The set of data may be stored at a plurality of servers, and a subset of the set of data may be stored at each server. Each server may determine at least one subset value associated with the type of aggregation of interest for the respective subset of data stored thereon. The subset value may be received from each server. An aggregation value may be determined based on combining the subset values from each server. The aggregation value may be communicated to the user client. A system and computer program product are also disclosed.

CROSS REFERENCE TO RELATED APPLICATION

This application claims priority to U.S. Patent Application No. 62/678,404, filed May 31, 2018, which is incorporated herein by reference in its entirety.

BACKGROUND 1. Field

The present disclosure relates generally to systems, apparatus, and methods for data aggregation and, in one particular embodiment, to a method, system, and computer program product for aggregating data from a plurality of sources.

2. Technical Considerations

Service providers in electronic networks may process a high volume of events (e.g., messages) every day. For example, a transaction service provider system in an electronic payment processing network may process thousands of transactions (e.g., authorization requests and/or authorization responses) per second. To evaluate a current event, both long term (e.g., days, weeks, months, years) and short term (e.g., seconds, minutes) data aggregations may be useful. An aggregation may include a process and/or function by which multiple pieces of data (e.g., rows, entries, and/or the like from a database of event/transaction data) are grouped together to form a single value. For the purpose of illustration, an aggregation may be a count, an average, a maximum, a minimum, a median, a mode, a sum, and/or the like. Additionally, aggregations of data may show historical trends, behaviors, and/or the like associated with various attributes.

However, due to the high volume and rapid nature of events being processed, in some instances, it may be difficult to calculate/obtain sufficiently accurate data aggregations quickly (e.g., within a desired range of latency). For example, certain current techniques for processing data/event streams (e.g., Storm, Spark Streaming, or Kafka) may proactively store the state of all variables of potential interest for every predetermined time period of potential interest. Such techniques may result in storing a very large and/or constantly increasing number of states, many of which are never actually used and, therefore, computing resources may be used inefficiently because a portion thereof may be devoted to (and wasted on) calculating and storing such states. Such large and/or increasing number of states may be referred to as a “state explosion.” For example, assuming 100 aggregations with 10 different window sizes are desired for making a certain decision/evaluation, even assuming a coarse-grained half window size for an advance interval in typical hopping window implementations, 2,000 state updates may be propagated for a single incoming event (e.g., transaction), and assuming 1,000 transactions per second (TPS), 2 million input/output (10) operations would occur each second. Moreover, such techniques may limit a user/requester of aggregations to only the predetermined time periods for such aggregations, thereby limiting the flexibility/precision of such aggregations. Alternatively, certain other current techniques store all incoming raw data (perhaps after some filtering) and wait to calculate any aggregations until requested. Such techniques may, upon receiving a request, search through the raw data directly to identify variables of interest identified in the request and then calculate the value of the requested aggregation. Such techniques may be very slow (e.g., high latency) because computing resources may be devoted to (and wasted on) checking a large amount of data to identify relatively small portions thereof relevant to the variables of interest.

Additionally, certain current techniques may include, in response to receiving a request for an aggregation from a user's device, transmitting back to that device all of the portions of the raw data identified as relevant to the variable of interest or only the proactively calculated aggregations for individual predetermined time periods. As such, the user's device may have to combine and/or perform calculations on the received raw data and/or partial aggregations to determine the final value of the aggregation of interest. However, such techniques may require transmitting a large amount of information over a network to the user's device and, therefore, network resources may be used inefficiently because a portion thereof may be devoted to (and wasted on) transmitting such voluminous information. Further, the user's device may have relatively limited resources with respect to the computing systems of the service provider from which the user's device requested the information. As such, the limited computing resources of the user's device may be used inefficiently because a portion thereof may be devoted to (and wasted on) calculating aggregations.

Moreover, all data necessary for determining certain aggregations may not be available from one source. For example, it may be difficult to store data at one source due to the size of the data. For the purpose of illustration, a transaction service provider may process thousands of transactions per second, and each transaction may include different types of data, such as primary account number (PAN), device identifications (DevicelDs), internet protocol (IP) address, user identification (userlD), and/or the like. There may be difficulty keeping all such data in one data source. Additionally or alternatively, data may be stored at various different sources for other factors. For example, some sources (or software thereof) may have high performance (e.g., increased speed, decreased latency, desirable features, and/or the like) but be relatively expensive (e.g., in terms of cost, computing resources, and/or the like), and other sources may have lower performance (e.g., decreased speed, increased latency, a lack of certain features, and/or the like) but be relatively inexpensive. For the purpose of illustration, some software (e.g., Redis) may have high performance but be relatively expensive. Additionally or alternatively, some sources (or software thereof) may have advantages and/or improved performance in some areas/contexts, but have disadvantages and/or decreased performance in other areas/contexts. Additionally or alternatively, some data may be stored (e.g., hosted, maintained, and/or the like) at a different site, by a different group within an organization, by a different organization (e.g., a third party), and/or the like.

SUMMARY

Accordingly, it is an object of the present disclosure to provide systems, methods, and computer program products for aggregating data from a plurality of sources that overcomes some or all of the deficiencies of the prior art.

According to non-limiting embodiments, provided is a method for aggregating data from a plurality of sources. In some non-limiting embodiments, a method for aggregating data from a plurality of sources may include receiving a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with a first set of data. The first set of data may be determined to be stored at a plurality of servers, wherein a first subset of the first set of data is stored at each server of the plurality of servers. Each server may be instructed to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon. The at least one first subset value may be received from each server. A first aggregation value may be determined based on combining the at least one first subset value from each server. The first aggregation value may be communicated to the user client.

According to non-limiting embodiments, provided is a system for aggregating data from a plurality of sources. In some non-limiting embodiments, the system for aggregating data from a plurality of sources may include a user client, a plurality of servers storing a first set of data, wherein a first subset of the first set of data is stored at each server of the plurality of servers, and at least one processor. The at least one processor may be programmed or configured to receive, from the user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with the first set of data. The first set of data may be determined to be stored at the plurality of servers. Each server may be instructed to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon. The at least one first subset value may be received from each server. The first aggregation value may be determined based on combining the at least one first subset value from each server. The first aggregation value may be communicated to the user client.

According to non-limiting embodiments, provided is a computer program product for aggregating data from a plurality of sources. The computer program product for aggregating data from a plurality of sources may include at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to perform any of the methods as described herein.

According to non-limiting embodiments, provided is a computer program product for aggregating data from a plurality of sources, the computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to: receive, from a user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with the first set of identification data; determine that the first set of data is stored at a plurality of servers; instruct each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receive the at least one first subset value from each server; determine the first aggregation value based on combining the at least one first subset value from each server; and communicate the first aggregation value to the user client.

Further embodiments or aspects are set forth in the following numbered clauses:

Clause 1: A method for aggregating data from a plurality of sources, comprising receiving, with at least one processor from a user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with a first set of data; determining, with the at least one processor, the first set of data is stored at a plurality of servers, wherein a first subset of the first set of data is stored at each server of the plurality of servers; instructing, with the at least one processor, each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receiving, with the at least one processor, the at least one first subset value from each server; determining, with the at least one processor, a first aggregation value based on combining the at least one first subset value from each server; and communicating, with the at least one processor, the first aggregation value to the user client.

Clause 2: The method of clause 1, wherein instructing each server to determine the at least one first subset value comprises instructing, by a distributed scheduler, each server to determine the at least one first subset value as part of a scheduled job at the respective server.

Clause 3: The method of clauses 1 or 2, wherein the first set of data comprises first payment transaction data associated with a first plurality of payment transactions during a period, and wherein the request comprises second payment transaction data associated with a payment transaction.

Clause 4: The method of any of clauses 1-3, wherein the second transaction data comprises a transaction amount of the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the transaction amount is above a threshold, and wherein the first type of aggregation of interest comprises a second set of aggregations if the transaction amount is below the threshold.

Clause 5: The method of any of clauses 1-4, wherein the second transaction data comprises an internet protocol (IP) address associated with the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the IP address is disreputable, and wherein the first type of aggregation of interest comprises a second set of aggregations if the IP address is reputable.

Clause 6: The method of any of clauses 1-5, further comprising: receiving, with the at least one processor, the first payment transaction data; determining, with the at least one processor, a first key associated with each payment transaction of the first plurality of payment transactions based on a first portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions and the first aggregation of interest data; and storing, with the at least one processor, a second portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions in a map data structure based on the first key of the respective payment transaction of the first plurality of payment transactions, wherein the first portion of the first payment transaction data and the second portion of the first payment transaction data are different.

Clause 7: The method of any of clauses 1-6, further comprising: sorting, with the at least one processor, the first keys associated with the first plurality of payment transactions based on the first aggregation of interest data.

Clause 8: The method of any of clauses 1-7, further comprising: identifying, by a first server of the plurality of servers, a first plurality of the first keys associated with the first subset of the first set of data stored on the first server; and determining, by the first server, the at least one first subset value for the first subset of the first set of data stored on the first server based on the first plurality of the first keys.

Clause 9: The method of any of clauses 1-8, wherein the period comprises a first time period, a plurality of second time periods, and a plurality of third time periods, the method further comprising: determining, by a first server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the first server, wherein the first subset of the first set of data stored on the first server is associated with the first time period; determining, by at least one second server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the at least one second server, wherein the first subset of the first set of data stored on the at least one second server is associated with the plurality of second time periods; and determining, by at least one third server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the at least one third server, wherein the first subset of the first set of data stored on the at least one third server is associated with the plurality of third time periods.

Clause 10: The method of any of clauses 1-9, wherein the first time period has a first duration, wherein each of the plurality of second time periods has a second duration, and each of the plurality of third time periods has a third duration, and further wherein the first duration is less than the second duration and the second duration is less than the third duration.

Clause 11: The method of any of clauses 1-10, wherein the second duration is an hour, the third duration is a day, and the first duration is a difference between a current time and an end of a previous hour.

Clause 12: A system for aggregating data from a plurality of sources, comprising: a user client; a plurality of servers storing a first set of data, wherein a first subset of the first set of data is stored at each server of the plurality of servers; and at least one processor, wherein the at least one processor is programmed or configured to: receive, from the user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with the first set of data; determine the first set of data is stored at the plurality of servers; instruct each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receive the at least one first subset value from each server; determine the first aggregation value based on combining the at least one first subset value from each server; and communicate the first aggregation value to the user client.

Clause 13: The system of clause 12, further comprising a distributed scheduler, wherein instructing each server to determine the at least one first subset value comprises instructing the distributed scheduler to instruct each server to determine the at least one first subset value as part of a scheduled job at the respective server.

Clause 14: The system of clauses 12 or 13, wherein the first set of data comprises first payment transaction data associated with a first plurality of payment transactions during a period, and wherein the request comprises second payment transaction data associated with a payment transaction.

Clause 15: The system of any of clauses 12-14, wherein the second transaction data comprises a transaction amount of the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the transaction amount is above a threshold, and wherein the first type of aggregation of interest comprises a second set of aggregations if the transaction amount is below the threshold.

Clause 16: The system any of clauses 12-15, wherein the second transaction data comprises an internet protocol (IP) address associated with the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the IP address is disreputable, and wherein the first type of aggregation of interest comprises a second set of aggregations if the IP address is reputable.

Clause 17: The system of any of clauses 12-16, wherein the at least one processor is further programmed or configured to: receive the first payment transaction data; determine a first key associated with each payment transaction of the first plurality of payment transactions based on a first portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions and the first aggregation of interest data; and store a second portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions in a map data structure based on the first key of the respective payment transaction of the first plurality of payment transactions, wherein the first portion of the first payment transaction data and the second portion of the first payment transaction data are different.

Clause 18: The system of any of clauses 12-17, wherein the at least one processor is further programmed or configured to: sort the first keys associated with the first plurality of payment transactions based on the first aggregation of interest data.

Clause 19: The system of any of clauses 12-18, wherein a first server of the plurality of servers is configured to: identify a first plurality of the first keys associated with the first subset of the first set of data stored on the first server; and determine the at least one first subset value for the first subset of the first set of data stored on the first server based on the first plurality of the first keys.

Clause 20: The system of any of clauses 12-19, wherein the period comprises a first time period, a plurality of second time periods, and a plurality of third time periods, wherein a first server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the first server, wherein the first subset of the first set of data stored on the first server is associated with the first time period; wherein at least one second server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the at least one second server, wherein the first subset of the first set of data stored on the at least one second server is associated with the plurality of second time periods; and wherein at least one third server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the at least one third server, wherein the first subset of the first set of data stored on the at least one third server is associated with the plurality of third time periods.

Clause 21: The system of any of clauses 12-20, wherein the first time period has a first duration, wherein each of the plurality of second time periods has a second duration, and each of the plurality of third time periods has a third duration, and further wherein the first duration is less than the second duration and the second duration is less than the third duration.

Clause 22: The system of any of clauses 12-21, wherein the second duration is an hour, the third duration is a day, and the first duration is a difference between a current time and an end of a previous hour.

Clause 23: A computer program product for aggregating data from a plurality of sources, the computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to perform the method of any one of claims 1-11.

Clause 24: A method for aggregating data from a plurality of sources, comprising: receiving, with at least one processor from a user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with a first set of data; determining, with the at least one processor, the first set of data is stored at a plurality of servers, wherein a first subset of the first set of data is stored at each server of the plurality of servers; instructing, with the at least one processor, each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receiving, with the at least one processor, the at least one first subset value from each server; determining, with the at least one processor, a first aggregation value based on combining the at least one first subset value from each server; and communicating, with the at least one processor, the first aggregation value to the user client.

Clause 25: The method of clause 24, wherein instructing each server to determine the at least one first subset value comprises instructing, by a distributed scheduler, each server to determine the at least one first subset value as part of a scheduled job at the respective server.

Clause 26: The method of clauses 24 or 25, wherein the first set of data comprises first payment transaction data associated with a first plurality of payment transactions during a period, and wherein the request comprises second payment transaction data associated with a payment transaction.

Clause 27: The method of any of clauses 24-26, wherein the second transaction data comprises a transaction amount of the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the transaction amount is above a threshold, and wherein the first type of aggregation of interest comprises a second set of aggregations if the transaction amount is below the threshold.

Clause 28: The method of any of clauses 24-27, wherein the second transaction data comprises an internet protocol (IP) address associated with the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the IP address is disreputable, and wherein the first type of aggregation of interest comprises a second set of aggregations if the IP address is reputable.

Clause 29: The method of any of clauses 24-28, further comprising: receiving, with the at least one processor, the first payment transaction data; determining, with the at least one processor, a first key associated with each payment transaction of the first plurality of payment transactions based on a first portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions and the first aggregation of interest data; and storing, with the at least one processor, a second portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions in a map data structure based on the first key of the respective payment transaction of the first plurality of payment transactions, wherein the first portion of the first payment transaction data and the second portion of the first payment transaction data are different.

Clause 30: The method of any of clauses 24-29, further comprising: sorting, with the at least one processor, the first keys associated with the first plurality of payment transactions based on the first aggregation of interest data.

Clause 31: The method of any of clauses 24-30, further comprising: identifying, by a first server of the plurality of servers, a first plurality of the first keys associated with the first subset of the first set of data stored on the first server; and determining, by the first server, the at least one first subset value for the first subset of the first set of data stored on the first server based on the first plurality of the first keys.

Clause 32: The method of any of clauses 24-31, wherein the period comprises a first time period, a plurality of second time periods, and a plurality of third time periods, the method further comprising: determining, by a first server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the first server, wherein the first subset of the first set of data stored on the first server is associated with the first time period; determining, by at least one second server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the at least one second server, wherein the first subset of the first set of data stored on the at least one second server is associated with the plurality of second time periods; and determining, by at least one third server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the at least one third server, wherein the first subset of the first set of data stored on the at least one third server is associated with the plurality of third time periods.

Clause 33: The method of any of clauses 24-32, wherein the first time period has a first duration, wherein each of the plurality of second time periods has a second duration, and each of the plurality of third time periods has a third duration, and further wherein the first duration is less than the second duration and the second duration is less than the third duration; and wherein the second duration is an hour, the third duration is a day, and the first duration is a difference between a current time and an end of a previous hour.

Clause 34: A system for aggregating data from a plurality of sources, comprising: a user client; a plurality of servers storing a first set of data, wherein a first subset of the first set of data is stored at each server of the plurality of servers; and at least one processor, wherein the at least one processor is programmed or configured to: receive, from the user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with the first set of data; determine the first set of data is stored at the plurality of servers; instruct each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receive the at least one first subset value from each server; determine the first aggregation value based on combining the at least one first subset value from each server; and communicate the first aggregation value to the user client.

Clause 35: The system of clause 34, further comprising a distributed scheduler, wherein instructing each server to determine the at least one first subset value comprises instructing the distributed scheduler to instruct each server to determine the at least one first subset value as part of a scheduled job at the respective server.

Clause 36: The system of clauses 33 or 35, wherein the first set of data comprises first payment transaction data associated with a first plurality of payment transactions during a period, and wherein the request comprises second payment transaction data associated with a payment transaction.

Clause 37: The system of any of clauses 33-36, wherein the second transaction data comprises a transaction amount of the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the transaction amount is above a threshold, and wherein the first type of aggregation of interest comprises a second set of aggregations if the transaction amount is below the threshold.

Clause 38: The system of any of clauses 33-37, wherein the second transaction data comprises an internet protocol (IP) address associated with the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the IP address is disreputable, and wherein the first type of aggregation of interest comprises a second set of aggregations if the IP address is reputable.

Clause 39: The system of any of clauses 33-38, wherein the at least one processor is further programmed or configured to: receive the first payment transaction data; determine a first key associated with each payment transaction of the first plurality of payment transactions based on a first portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions and the first aggregation of interest data; and store a second portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions in a map data structure based on the first key of the respective payment transaction of the first plurality of payment transactions, wherein the first portion of the first payment transaction data and the second portion of the first payment transaction data are different.

Clause 40: The system of any of clauses 33-39, wherein the at least one processor is further programmed or configured to: sort the first keys associated with the first plurality of payment transactions based on the first aggregation of interest data.

Clause 41: The system of any of clauses 33-40, wherein a first server of the plurality of servers is configured to: identify a first plurality of the first keys associated with the first subset of the first set of data stored on the first server; and determine the at least one first subset value for the first subset of the first set of data stored on the first server based on the first plurality of the first keys.

Clause 42: The system of any of clauses 33-41 wherein the period comprises a first time period, a plurality of second time periods, and a plurality of third time periods, wherein a first server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the first server, wherein the first subset of the first set of data stored on the first server is associated with the first time period; wherein at least one second server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the at least one second server, wherein the first subset of the first set of data stored on the at least one second server is associated with the plurality of second time periods; wherein at least one third server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the at least one third server, wherein the first subset of the first set of data stored on the at least one third server is associated with the plurality of third time periods; wherein the first time period has a first duration, wherein each of the plurality of second time periods has a second duration, and each of the plurality of third time periods has a third duration, and further wherein the first duration is less than the second duration and the second duration is less than the third duration; and wherein the second duration is an hour, the third duration is a day, and the first duration is a difference between a current time and an end of a previous hour.

Clause 43: A computer program product for aggregating data from a plurality of sources, the computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to: receive, from a user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with the first set of identification data; determine that the first set of data is stored at a plurality of servers; instruct each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receive the at least one first subset value from each server; determine the first aggregation value based on combining the at least one first subset value from each server; and communicate the first aggregation value to the user client.

These and other features and characteristics of the present disclosure, as well as the methods of operation and functions of the related elements of structures and the combination of parts and economies of manufacture, will become more apparent upon consideration of the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification, wherein like reference numerals designate corresponding parts in the various figures. It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the present disclosure. As used in the specification and the claims, the singular form of “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise.

BRIEF DESCRIPTION OF THE DRAWINGS

Additional advantages and details of the present disclosure are explained in greater detail below with reference to the exemplary embodiments that are illustrated in the accompanying figures, in which:

FIG. 1 is a diagram of a non-limiting embodiment of an environment in which systems, apparatus, and/or methods, described herein, may be implemented according to the principles of the present disclosure;

FIG. 2 is a diagram of a non-limiting embodiment of components of one or more devices of FIG. 1;

FIG. 3 is a flowchart of a non-limiting embodiment of a process for data aggregation according to the principles of the present disclosure;

FIG. 4 is a diagram of an implementation of a non-limiting embodiment of the process shown in FIG. 3;

FIG. 5 is a diagram of an implementation of a non-limiting embodiment of the process shown in FIG. 3;

FIG. 6 is a diagram of an implementation of a non-limiting embodiment of the process shown in FIG. 3;

FIG. 7 is a diagram of an implementation of a non-limiting embodiment of the process shown in FIG. 3;

FIG. 8 is a diagram of a seven-day data aggregation according to a non-limiting embodiment of the process shown in FIG. 3;

FIG. 9 is a diagram of an implementation of a non-limiting embodiment of the process shown in FIG. 3; and

FIG. 10 is a diagram of an implementation of a non-limiting embodiment of the process shown in FIG. 3.

DETAILED DESCRIPTION

For purposes of the description hereinafter, the terms “end,” “upper,” “lower,” “right,” “left,” “vertical,” “horizontal,” “top,” “bottom,” “lateral,” “longitudinal,” and derivatives thereof shall relate to the present disclosure as it is oriented in the drawing figures. However, it is to be understood that the present disclosure may assume various alternative variations and step sequences, except where expressly specified to the contrary. It is also to be understood that the specific devices and processes illustrated in the attached drawings, and described in the following specification, are simply exemplary embodiments or aspects of the present disclosure. Hence, specific dimensions and other physical characteristics related to the embodiments or aspects of the embodiments disclosed herein are not to be considered as limiting unless otherwise indicated.

No aspect, component, element, structure, act, step, function, instruction, and/or the like used herein should be construed as critical or essential unless explicitly described as such. Also, as used herein, the articles “a” and “an” are intended to include one or more items, and may be used interchangeably with “one or more” and “at least one.” Furthermore, as used herein, the term “set” is intended to include one or more items (e.g., related items, unrelated items, a combination of related and unrelated items, and/or the like) and may be used interchangeably with “one or more” or “at least one.” Where only one item is intended, the term “one” or similar language is used. Also, as used herein, the terms “has,” “have,” “having,” or the like are intended to be open-ended terms. Further, the phrase “based on” is intended to mean “based at least partially on” unless explicitly stated otherwise.

As used herein, the terms “communication” and “communicate” may refer to the reception, receipt, transmission, transfer, provision, and/or the like of information (e.g., data, signals, messages, instructions, commands, and/or the like). For one unit (e.g., a device, a system, a component of a device or system, combinations thereof, and/or the like) to be in communication with another unit means that the one unit is able to directly or indirectly receive information from and/or transmit information to the other unit. This may refer to a direct or indirect connection (e.g., a direct communication connection, an indirect communication connection, and/or the like) that is wired and/or wireless in nature. Additionally, two units may be in communication with each other even though the information transmitted may be modified, processed, relayed, and/or routed between the first and second unit. For example, a first unit may be in communication with a second unit even though the first unit passively receives information and does not actively transmit information to the second unit. As another example, a first unit may be in communication with a second unit if at least one intermediary unit (e.g., a third unit located between the first unit and the second unit) processes information received from the first unit and communicates the processed information to the second unit. In some non-limiting embodiments, a message may refer to a network packet (e.g., a data packet and/or the like) that includes data. It will be appreciated that numerous other arrangements are possible.

As used herein, the terms “issuer institution,” “portable financial device issuer,” “issuer,” or “issuer bank” may refer to one or more entities that provide accounts to customers for conducting transactions (e.g., payment transactions), such as initiating credit and/or debit payments. For example, an issuer institution may provide an account identifier, such as a primary account number (PAN), to a customer that uniquely identifies one or more accounts associated with that customer. The account identifier may be embodied on a portable financial device, such as a physical financial instrument, e.g., a payment card, and/or may be electronic and used for electronic payments. The terms “issuer institution” and “issuer institution system” may also refer to one or more computer systems operated by or on behalf of an issuer institution, such as a server computer executing one or more software applications. For example, an issuer institution system may include one or more authorization servers for authorizing a transaction.

As used herein, the term “account identifier” may include one or more types of identifiers associated with a user account (e.g., a PAN, a card number, a payment card number, a token, and/or the like). In some non-limiting embodiments, an issuer institution may provide an account identifier (e.g., a PAN, a token, and/or the like) to a user that uniquely identifies one or more accounts associated with that user. The account identifier may be embodied on a physical financial instrument (e.g., a portable financial instrument, a payment card, a credit card, a debit card, and/or the like) and/or may be electronic information communicated to the user that the user may use for electronic payments. In some non-limiting embodiments, the account identifier may be an original account identifier, where the original account identifier was provided to a user at the creation of the account associated with the account identifier. In some non-limiting embodiments, the account identifier may be an account identifier (e.g., a supplemental account identifier) that is provided to a user after the original account identifier was provided to the user. For example, if the original account identifier is forgotten, stolen, and/or the like, a supplemental account identifier may be provided to the user. In some non-limiting embodiments, an account identifier may be directly or indirectly associated with an issuer institution such that an account identifier may be a token that maps to a PAN or other type of identifier. Account identifiers may be alphanumeric, any combination of characters and/or symbols, and/or the like. An issuer institution may be associated with a bank identification number (BIN) that uniquely identifies the issuer institution.

As used herein, the term “token” may refer to an identifier that is used as a substitute or replacement identifier for an account identifier, such as a PAN. Tokens may be associated with a PAN or other account identifiers in one or more data structures (e.g., one or more databases, and/or the like) such that they can be used to conduct a transaction (e.g., a payment transaction) without directly using the account identifier, such as a PAN. In some examples, an account identifier, such as a PAN, may be associated with a plurality of tokens for different individuals, different uses, and/or different purposes.

As used herein, the term “merchant” may refer to one or more entities (e.g., operators of retail businesses that provide goods and/or services, and/or access to goods and/or services, to a user (e.g., a customer, a consumer, a customer of the merchant, and/or the like) based on a transaction (e.g., a payment transaction)). As used herein “merchant system” may refer to one or more computer systems operated by or on behalf of a merchant, such as a server computer executing one or more software applications. As used herein, the term “product” may refer to one or more goods and/or services offered by a merchant.

As used herein, a “point-of-sale (POS) device” may refer to one or more devices, which may be used by a merchant to initiate transactions (e.g., a payment transaction), engage in transactions, and/or process transactions. For example, a POS device may include one or more computers, peripheral devices, card readers, near-field communication (NFC) receivers, radio frequency identification (RFID) receivers, and/or other contactless transceivers or receivers, contact-based receivers, payment terminals, computers, servers, input devices, and/or the like.

As used herein, the term “point-of-sale (POS) system” may refer to one or more computers and/or peripheral devices used by a merchant to conduct a transaction. For example, a POS system may include one or more POS devices and/or other like devices that may be used to conduct a payment transaction. A POS system (e.g., a merchant POS system) may also include one or more server computers programmed or configured to process online payment transactions through webpages, mobile applications, and/or the like.

As used herein, the term “transaction service provider” may refer to an entity that receives transaction authorization requests from merchants or other entities and provides guarantees of payment, in some cases through an agreement between the transaction service provider and the issuer institution. In some non-limiting embodiments, a transaction service provider may include a credit card company, a debit card company, and/or the like. As used herein, the term “transaction service provider system” may also refer to one or more computer systems operated by or on behalf of a transaction service provider, such as a transaction processing server executing one or more software applications. A transaction processing server may include one or more processors and, in some non-limiting embodiments, may be operated by or on behalf of a transaction service provider.

As used herein, the term “acquirer” may refer to an entity licensed by the transaction service provider and approved by the transaction service provider to originate transactions (e.g., payment transactions) using a portable financial device associated with the transaction service provider. As used herein, the term “acquirer system” may also refer to one or more computer systems, computer devices, and/or the like operated by or on behalf of an acquirer. The transactions the acquirer may originate may include payment transactions (e.g., purchases, original credit transactions (OCTs), account funding transactions (AFTs), and/or the like). In some non-limiting embodiments, the acquirer may be authorized by the transaction service provider to assign merchant or service providers to originate transactions using a portable financial device of the transaction service provider. The acquirer may contract with payment facilitators to enable the payment facilitators to sponsor merchants. The acquirer may monitor compliance of the payment facilitators in accordance with regulations of the transaction service provider. The acquirer may conduct due diligence of the payment facilitators and ensure that proper due diligence occurs before signing a sponsored merchant. The acquirer may be liable for all transaction service provider programs that the acquirer operates or sponsors. The acquirer may be responsible for the acts of the acquirer's payment facilitators, merchants that are sponsored by an acquirer's payment facilitators, and/or the like. In some non-limiting embodiments, an acquirer may be a financial institution, such as a bank.

As used herein, the terms “electronic wallet,” “electronic wallet mobile application,” and “digital wallet” may refer to one or more electronic devices and/or one or more software applications configured to initiate and/or conduct transactions (e.g., payment transactions, electronic payment transactions, and/or the like). For example, an electronic wallet may include a user device (e.g., a mobile device) executing an application program and server-side software and/or databases for maintaining and providing transaction data to the user device. As used herein, the term “electronic wallet provider” may include an entity that provides and/or maintains an electronic wallet and/or an electronic wallet mobile application for a user (e.g., a customer). Examples of an electronic wallet provider include, but are not limited to, Google Pay®, Android Pay®, Apple Pay®, and Samsung Pay®. In some non-limiting examples, a financial institution (e.g., an issuer institution) may be an electronic wallet provider. As used herein, the term “electronic wallet provider system” may refer to one or more computer systems, computer devices, servers, groups of servers, and/or the like operated by or on behalf of an electronic wallet provider.

As used herein, the term “portable financial device” may refer to a payment card (e.g., a credit or debit card), a gift card, a smartcard, smart media, a payroll card, a healthcare card, a wristband, a machine-readable medium containing account information, a keychain device or fob, an RFID transponder, a retailer discount or loyalty card, a cellular phone, an electronic wallet mobile application, a personal digital assistant (PDA), a pager, a security card, a computer, an access card, a wireless terminal, a transponder, and/or the like. In some non-limiting embodiments, the portable financial device may include volatile or non-volatile memory to store information (e.g., an account identifier, a name of the account holder, and/or the like).

As used herein, the term “payment gateway” may refer to an entity and/or a payment processing system operated by or on behalf of such an entity (e.g., a merchant service provider, a payment service provider, a payment facilitator, a payment facilitator that contracts with an acquirer, a payment aggregator, and/or the like), which provides payment services (e.g., transaction service provider payment services, payment processing services, and/or the like) to one or more merchants. The payment services may be associated with the use of portable financial devices managed by a transaction service provider. As used herein, the term “payment gateway system” may refer to one or more computer systems, computer devices, servers, groups of servers, and/or the like operated by or on behalf of a payment gateway and/or to a payment gateway itself. The term “payment gateway mobile application” may refer to one or more electronic devices and/or one or more software applications configured to provide payment services for transactions (e.g., payment transactions, electronic payment transactions, and/or the like).

As used herein, the terms “client” and “client device” may refer to one or more client-side devices or systems (e.g., remote from a transaction service provider) used to initiate or facilitate a transaction (e.g., a payment transaction). As an example, a “client device” may refer to one or more POS devices used by a merchant, one or more acquirer host computers used by an acquirer, one or more mobile devices used by a user, and/or the like. In some non-limiting embodiments, a client device may be an electronic device configured to communicate with one or more networks and initiate or facilitate transactions. For example, a client device may include one or more computers, portable computers, laptop computers, tablet computers, mobile devices, cellular phones, wearable devices (e.g., watches, glasses, lenses, clothing, and/or the like), PDAs, and/or the like. Moreover, a “client” may also refer to an entity (e.g., a merchant, an acquirer, and/or the like) that owns, utilizes, and/or operates a client device for initiating transactions (e.g., for initiating transactions with a transaction service provider).

As used herein, the term “server” may refer to one or more computing devices (e.g., processors, storage devices, similar computer components, and/or the like) that communicate with client devices and/or other computing devices over a network (e.g., a public network, the Internet, a private network, and/or the like) and, in some examples, facilitate communication among other servers and/or client devices. It will be appreciated that various other arrangements are possible. As used herein, the term “system” may refer to one or more computing devices or combinations of computing devices (e.g., processors, servers, client devices, software applications, components of such, and/or the like). Reference to “a device,” “a server,” “a processor,” and/or the like, as used herein, may refer to a previously-recited device, server, or processor that is recited as performing a previous step or function, a different server or processor, and/or a combination of servers and/or processors. For example, as used in the specification and the claims, a first server or a first processor that is recited as performing a first step or a first function may refer to the same or different server or the same or different processor recited as performing a second step or a second function.

Non-limiting embodiments of the disclosed subject matter are directed systems, methods, and computer program products for aggregation of data, including, but not limited to, real-time event data such as transaction data from an electronic payment network. For example, non-limiting embodiments of the disclosed subject matter provide determining one or more key(s) based on one or more portion(s) of the data for each event (e.g., transaction). Such embodiments provide the techniques and systems for quickly and efficiently determining values for requested aggregations through using the key(s) to efficiently store and/or sort the data in one or more map data structure(s) such that data is highly accessible (e.g., data entries can be quickly searched to identify relevant entries by searching just the (sorted) key(s) associated with each entry) and computation can be reduced, for example, in comparison to techniques that search through raw data directly. Moreover, the aggregations may be determined/calculated reactively, e.g., only in response to user requests, without the need to proactively calculate/store the state of all variables of potential interest for every predetermined time period of potential interest, thus providing the advantage of saving the computing resources such proactive techniques devote to calculate and store such information while providing similarly low latency and greater flexibility.

Additionally or alternatively, non-limiting embodiments of the disclosed subject matter provide the techniques and systems for balancing reactive and proactive determination of aggregation values. For example, non-limiting embodiments of the disclosed subject matter may proactively determine aggregations for longer term periods (e.g., hours, days, weeks, months, years) and reactively determine aggregations for shorter term periods. Such embodiments may include dividing a requested time period into portions for which proactively calculated aggregations have been determined (e.g., full days and/or full hours within the one-week period prior to the current time) and a remaining portion for which proactively calculated aggregations have not been determined (e.g., a portion of an hour between the current time and the next hour) so that an aggregation may be determined using the key(s) corresponding to just the data entries within the remaining portion of time. Thus, such embodiments provide the advantage of trading off/balancing the low latency of having some proactively determined aggregations (without devoting too much computing resources since proactive aggregations are limited to (longer-term) predetermined periods) with the flexibility of reactive determination of aggregations for the remaining portion of a requested time period (without overly increasing the latency since reactive aggregations are limited to (shorter-term) portions of the time period).

Additionally or alternatively, non-limiting embodiments of the disclosed subject matter provide determining/calculating the value of a requested aggregation at the system (e.g., server, device, and/or the like) in which the data is stored and communicating the value of the requester. For example, the request from a client device/system may include the aggregation(s) desired, and the response to that request may include the final value(s) of the aggregation(s) after such value(s) are determined/calculated. As such, embodiments of the disclosed subject matter provide the advantage of limiting the amount of information (e.g., indications of desired aggregations and/or final values thereof rather than raw data and/or values of proactively determined portions of the aggregations) communicated over a network connecting the client to the system storing the data, thereby reducing bandwidth and/or decreasing the use of other network resources. Additionally or alternatively, embodiments of the disclosed subject matter provide the advantage of determining/calculating the value of the requested aggregations at the system where the data is stored rather than at the client device that requested the data, thereby preserving computing resources of the client device (which may have less computing power/resources than the system on which data is stored) and reducing latency (e.g., since determinations/calculations are performed at a system with relatively greater computing power/resources than the client device and less information is communicated over the network).

Additionally or alternatively, non-limiting embodiments of the disclosed subject matter provide aggregating data from a plurality of sources. For example, data for a requested aggregation may be determined to be stored at a plurality of servers, wherein a subset of the data is stored at each server of the plurality of servers. Each server may be instructed to determine at least one first subset value associated with the requested aggregation for the respective subset of data stored thereon, and those subset values may be combined to determine the (full) aggregation value. As such, embodiments of the disclosed subject matter provide the advantage of combining data from multiple sources into a single aggregation. For the purpose of illustration, data that cannot be stored at a single data source because of its size and/or data that is advantageously stored at different data sources for other reasons (e.g., balancing performance of data sources with costs, some sources having advantages in some areas/contexts but not others, and/or data being stored at different sites, by different groups, by different organizations, and/or the like) may be combined into a single aggregation. Additionally or alternatively, embodiments of the disclosed subject matter provide the advantage of parallelization (e.g., allow for distributed storing at multiple servers and/or distributed processing at multiple servers simultaneously).

For the purpose of illustration, in the following description, the present disclosed subject matter is described with respect to systems, methods, and computer program products for aggregating data from payment transactions, one skilled in the art will recognize that the disclosed subject matter is not limited to the illustrative embodiments. For example, the systems, methods, and computer program products described herein may be used with a wide variety of settings, such as aggregating data related to other types of events, messages, and/or interactions involving any device(s), system(s), network(s), and/or combinations thereof, or any other suitable setting for providing data aggregations.

Referring now to FIG. 1, FIG. 1 is a diagram of a non-limiting embodiment of an environment 100 in which systems, apparatus, and/or methods, as described herein, may be implemented. As shown in FIG. 1, environment 100 includes transaction service provider system 102, issuer system 104, customer device 106, merchant system 108, acquirer system 110, and network 112.

Transaction service provider system 102 may include one or more devices capable of receiving information from and/or communicating information to issuer system 104, customer device 106, merchant system 108, and/or acquirer system 110 via network 112. For example, transaction service provider system 102 may include a computing device, such as a server (e.g., a transaction processing server), a group of servers, and/or other like devices. In some non-limiting embodiments, transaction service provider system 102 may be associated with a transaction service provider as described herein. In some non-limiting embodiments, transaction service provider system 102 may be in communication with a data storage device, which may be local or remote to transaction service provider system 102. In some non-limiting embodiments, transaction service provider system 102 may be capable of receiving information from, storing information in, communicating information to, or searching information stored in the data storage device.

Issuer system 104 may include one or more devices capable of receiving information and/or communicating information to transaction service provider system 102, customer device 106, merchant system 108, and/or acquirer system 110 via network 112. For example, issuer system 104 may include a computing device, such as a server, a group of servers, and/or other like devices. In some non-limiting embodiments, issuer system 104 may be associated with an issuer institution as described herein. For example, issuer system 104 may be associated with an issuer institution that issued a credit account, debit account, credit card, debit card, and/or the like to a user associated with customer device 106.

Customer device 106 may include one or more devices capable of receiving information from and/or communicating information to transaction service provider system 102, issuer system 104, merchant system 108, and/or acquirer system 110 via network 112. For example, customer device 106 may include a client device and/or the like. In some non-limiting embodiments, customer device 106 may or may not be capable of receiving information (e.g., from merchant system 108) via a short-range wireless communication connection (e.g., an NFC communication connection, an RFID communication connection, a Bluetooth® communication connection, and/or the like), and/or communicating information (e.g., to merchant system 108) via a short-range wireless communication connection.

Merchant system 108 may include one or more devices capable of receiving information from and/or communicating information to transaction service provider system 102, issuer system 104, customer device 106, and/or acquirer system 110 via network 112. Merchant system 108 may also include a device capable of receiving information from customer device 106 via network 112, a communication connection (e.g., an NFC communication connection, an RFID communication connection, a Bluetooth® communication connection, and/or the like) with customer device 106, and/or the like, and/or communicating information to customer device 106 via the network, the communication connection, and/or the like. In some non-limiting embodiments, merchant system 108 may include a computing device, such as a server, a group of servers, a client device, a group of client devices, and/or other like devices. In some non-limiting embodiments, merchant system 108 may be associated with a merchant as described herein. In some non-limiting embodiments, merchant system 108 may include one or more client devices. For example, merchant system 108 may include a client device that allows a merchant to communicate information to transaction service provider system 102. In some non-limiting embodiments, merchant system 108 may include one or more devices, such as computers, computer systems, and/or peripheral devices capable of being used by a merchant to conduct a transaction with a user. For example, merchant system 108 may include a POS device and/or a POS system.

Acquirer system 110 may include one or more devices capable of receiving information from and/or communicating information to transaction service provider system 102, issuer system 104, customer device 106, and/or merchant system 108 via network 112. For example, acquirer system 110 may include a computing device, a server, a group of servers, and/or the like. In some non-limiting embodiments, acquirer system 110 may be associated with an acquirer as described herein.

Network 112 may include one or more wired and/or wireless networks. For example, network 112 may include a cellular network (e.g., a long-term evolution (LTE) network, a third generation (3G) network, a fourth generation (4G) network, a code division multiple access (CDMA) network, and/or the like), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., the public switched telephone network (PSTN)), a private network (e.g., a private network associated with a transaction service provider), an ad hoc network, an intranet, the Internet, a fiber optic-based network, a cloud computing network, and/or the like, and/or a combination of these or other types of networks.

The number and arrangement of systems, devices, and/or networks shown in FIG. 1 are provided as an example. There may be additional systems, devices, and/or networks; fewer systems, devices, and/or networks; different systems, devices, and/or networks; and/or differently arranged systems, devices, and/or networks than those shown in FIG. 1. Furthermore, two or more systems or devices shown in FIG. 1 may be implemented within a single system or device, or a single system or device shown in FIG. 1 may be implemented as multiple, distributed systems or devices. Additionally, or alternatively, a set of systems (e.g., one or more systems) or a set of devices (e.g., one or more devices) of environment 100 may perform one or more functions described as being performed by another set of systems or another set of devices of environment 100.

Referring now to FIG. 2, FIG. 2 is a diagram of example components of a device 200. Device 200 may correspond to one or more devices of transaction service provider system 102, one or more devices of issuer system 104, customer device 106, one or more devices of merchant system 108, and/or one or more devices of acquirer system 110. In some non-limiting embodiments, transaction service provider system 102, issuer system 104, customer device 106, merchant system 108, and/or acquirer system 110 may include at least one device 200 and/or at least one component of device 200. As shown in FIG. 2, device 200 may include bus 202, processor 204, memory 206, storage component 208, input component 210, output component 212, and communication interface 214.

Bus 202 may include a component that permits communication among the components of device 200. In some non-limiting embodiments, processor 204 may be implemented in hardware, firmware, or a combination of hardware and software. For example, processor 204 may include a processor (e.g., a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), and/or the like), a microprocessor, a digital signal processor (DSP), and/or any processing component (e.g., a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), and/or the like), and/or the like, which can be programmed to perform a function. Memory 206 may include random access memory (RAM), read only memory (ROM), and/or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, optical memory, and/or the like) that stores information and/or instructions for use by processor 204.

Storage component 208 may store information and/or software related to the operation and use of device 200. For example, storage component 208 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid state disk, and/or the like), a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a cartridge, a magnetic tape, and/or another type of computer-readable medium, along with a corresponding drive.

Input component 210 may include a component that permits device 200 to receive information, such as via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, a button, a switch, a microphone, and/or the like). Additionally, or alternatively, input component 210 may include a sensor for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, an actuator, and/or the like). Output component 212 may include a component that provides output information from device 200 (e.g., a display, a speaker, one or more light-emitting diodes (LEDs), and/or the like).

Communication interface 214 may include a transceiver-like component (e.g., a transceiver, a receiver and transmitter that are separate, and/or the like) that enables device 200 to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface 214 may permit device 200 to receive information from another device and/or provide information to another device. For example, communication interface 214 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi® interface, a cellular network interface, and/or the like.

Device 200 may perform one or more processes described herein. Device 200 may perform these processes based on processor 204 executing software instructions stored by a computer-readable medium, such as memory 206 and/or storage component 208. A computer-readable medium (e.g., a non-transitory computer-readable medium) is defined herein as a non-transitory memory device. A memory device includes memory space located inside of a single physical storage device or memory space spread across multiple physical storage devices.

Software instructions may be read into memory 206 and/or storage component 208 from another computer-readable medium or from another device via communication interface 214. When executed, software instructions stored in memory 206 and/or storage component 208 may cause processor 204 to perform one or more processes described herein. Additionally, or alternatively, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Thus, embodiments described herein are not limited to any specific combination of hardware circuitry and software.

The number and arrangement of components shown in FIG. 2 are provided as an example. In some non-limiting embodiments, device 200 may include additional components, fewer components, different components, or differently arranged components than those shown in FIG. 2. Additionally, or alternatively, a set of components (e.g., one or more components) of device 200 may perform one or more functions described as being performed by another set of components of device 200.

Referring now to FIG. 3, FIG. 3 is a flowchart of a non-limiting embodiment of a process 300 for aggregating data from events (e.g., payment transactions). In some non-limiting embodiments, one or more of the steps of process 300 may be performed (e.g., completely, partially, and/or the like) by transaction service provider system 102. In some non-limiting embodiments, one or more of the steps of process 300 may be performed (e.g., completely, partially, and/or the like) by another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

As shown in FIG. 3, at step 310, process 300 may include receiving data (e.g., event or transaction data). For example, transaction service provider system 102 may receive transaction data associated with a plurality of payment transactions from an electronic payment network (e.g., network 112). Additionally or alternatively, the transaction data (or a portion thereof) may be received from a database, an application programming interface (API) coupled to another device and/or system (e.g., issuer system 104, customer device 106, merchant system 108, or acquirer system 110), and/or a messaging cluster (e.g., a Kafka messaging cluster). In some non-limiting embodiments, transaction service provider system 102 may include a messaging cluster, and the data may be received at the messaging cluster in one or more streams.

In some non-limiting embodiments, a portion of the data may be filtered after receipt thereof. For example, transaction service provider system 102 may filter a portion of the transaction data associated with each transaction of the plurality of payment transactions. In some non-limiting embodiments, filtering may include discarding the filtered portion of the data based on the type(s) of aggregations of interest, as described herein. For example, if some portion(s) of the transaction data will not be used to calculate any identified aggregations of interest, such portion(s) may be filtered out so that only the relevant portions (e.g., portions potentially usable to calculate at least one aggregation of interest) are processed and/or stored, as described herein.

In some non-limiting embodiments, at least a portion of the data may be encrypted after receipt thereof. For example, transaction service provider system 102 may encrypt all of or a portion of the transaction data associated with each transaction of the plurality of payment transactions. The encryption may include any suitable cryptographic technique to protect the privacy of the data or portions thereof.

As shown in FIG. 3, at step 320, process 300 may include receiving aggregation of interest data. For example, transaction service provider system 102 (or a device thereof) may receive first aggregation of interest data associated with a type of aggregation of interest from a client device (e.g., a device of issuer system 104, a customer device 106, a device of merchant system 108, a device of acquirer system 110, and/or another device of transaction service provider system 102). The first aggregation of interest data may be any suitable indication or information that identifies at least one type of aggregation of interest. For example, the first aggregation of interest data may be included in a configuration file identifying one or more aggregations of interest. Additionally or alternatively, the first aggregation of interest data may be included in a request from a client device that also includes a request for a particular aggregation, as described herein.

In some non-limiting embodiments, second aggregation of interest data associated with a second type of aggregation of interest may be received. For example, the second aggregation of interest data may be a second type of aggregation of interest identified in the first configuration file, a new type of aggregation of interest included in a second or subsequent configuration file, and/or a new type of aggregation in an update message to update the existing configuration file. Additionally or alternatively, the second aggregation of interest data may be included in a request from a client device that also includes a request for a particular aggregation, as described herein. The second aggregation of interest data may identify a new type of aggregation of interest (e.g., a type of aggregation of interest different from the type identified in the first aggregation of interest data) and/or a change to or removal of a type of aggregation of interest from the first aggregation of interest data.

In some non-limiting embodiments, transaction service provider system 102 (or a device thereof) may receive a first request from a client device (e.g., a device of issuer system 104, a customer device 106, a device of merchant system 108, a device of acquirer system 110, and/or another device of transaction service provider system 102), and the first request may include first aggregation of interest data associated with a type of aggregation of interest and first set identification data associated with a first set of data.

As shown in FIG. 3, at step 330, process 300 may include determining a key for each data entry (e.g., each event or transaction). For example, transaction service provider system 102 may determine a first key associated with each transaction of the plurality of payment transactions based on a first portion of the transaction data associated with each transaction and the first aggregation of interest data. For example, the first portion of the transaction data may be selected to uniquely identify each transaction and include some information relevant to (e.g., usable in the determination/calculation of) the type of aggregation of interest so that relevant transactions may be quickly identified (e.g., when sorted, as described herein) in response to a user request for a particular aggregation. For example, if the type of aggregation of interest is a count of device identifications (DeviceIDs) associated with a particular IP address, the key for each transaction may include a compound string in the form of IP:Timestamp (where IP is the IP address for each transaction and Timestamp is the time of each transaction), and other portions of the data for each transaction (e.g., DeviceId, UserID, PAN, etc.) may be stored as values associated with each key of the respective transaction.

For the purpose of illustration, the system (e.g., transaction service provider system 102) may be tasked with computing a large number of concurrent aggregations (e.g., hundreds of aggregations for a single payment transaction event) with extremely low latency (e.g., within tens of milliseconds (ms), less than 10 ms, 2 ms, 1 ms, etc.). As such, highly efficient data organization may be useful to improve data access and reduce computation. Additionally or alternatively, the data structure may be extensible such that new data sources may be incorporated, new types of aggregations may be incorporated/determined, and/or new stream operations may be incorporated (e.g., in response to receiving a new configuration file, as described herein). In some non-limiting embodiments, the data/data structure may be stored in a distributed in-memory cache, as described herein, to allow scalability (e.g., in response to increased demand from new data sources, new types of aggregations of interest, and/or new requests for particular aggregations). Accordingly, a key-value pair may be used for efficiently organizing and/or storing the data (e.g., transaction data), and such data may be accessed via keyed access (e.g., value=map.get(key), as described herein) with O(1) complexity (e.g., where O is “Big O” notation, i.e., the order of function). For example, using keyed access may, in some instances, avoid and/or obviate the need for searching/scanning operations, which can be expensive in terms of computational resources (e.g., having complexity at O(N) scale, where N is the number of the data elements in the system). In some non-limiting embodiments, for an incoming payment transaction, based on the types of aggregations identified in the aggregation of interest data, the key(s) for the payment transaction may correspond to different aggregations for faster access and aggregation computations, as described herein. When a request for a particular aggregation (e.g., “What is the count of DeviceIDs associated with the IP address 10.1.2.3 in the past 5 minutes?”) is received, as described herein, the transaction data for the transactions relevant to determining/calculating that aggregation can be readily identified, as described herein.

In some non-limiting embodiments, additional keys for each transaction may be determined. For example, transaction service provider system 102 may determine a second key associated with each transaction of the plurality of payment transactions based on a second portion of the transaction data associated with each transaction and the second aggregation of interest data. For the purpose of illustration, the first key may be the compound string of IP:Timestamp, as described above, and the second aggregation of interest may be a count of card uses in a particular time period. In such an illustrative scenario, the second key may be the account identifier/PAN, a compound string of the account identifier/PAN and the time (e.g., PAN:Timestamp), and/or the like.

As shown in FIG. 3, at step 340, process 300 may include storing the data in a map data structure. For example, transaction service provider system 102 may store the transaction data in a map data structure associating the key(s) for each transaction with the values of (at least some of) the remaining portions of the transaction data for each transaction, as described herein. In some non-limiting embodiments, transaction service provider system 102 may use a first portion of the data to determine the key for each transaction, as described herein, and may store a second portion of the transaction data associated with each transaction in a map data structure based on the first key of the respective transaction of the plurality of payment transactions, wherein the first portion of the transaction data and the second portion of the transaction data are different.

In some non-limiting embodiments, at least one time duration of interest may be determined (e.g., by transaction service provider system 102) based on the first aggregation of interest data associated with the type of aggregation of interest. For example, the type of aggregation of interest may be most commonly requested for time periods of certain durations or less than a certain duration (e.g., up to one day/24 hours, or up to one week, and/or the like), and therefore the time duration of interest may be a portion of that certain duration (e.g., a time duration of interest of one hour, and/or a time duration of interest of one day, and/or the like, respectively).

Additionally or alternatively, the map data structure may be divided (e.g., by transaction service provider system 102) into a plurality of time-based map data structures, and each time-based map data structure may include a plurality of keys and the corresponding second portion of the transaction data associated with a subset of the plurality of payment transactions such that the plurality of keys includes all keys associated with a time period having a time duration equal to the time duration of interest, wherein the time period for each second plurality of keys is different than the time period for each other second plurality of keys. For example, if the time duration of interest is one hour, a map data structure may be divided into 24one-hour time-based map data structures per day, and a first one-hour time-based data structure may have all keys and corresponding second portions of the transaction data for all transactions within a first hour of the day (e.g., timestamp between 00:00 and 01:00), a second one-hour time-based data structure may have all keys and corresponding second portions of the transaction data for all transactions within a second hour of the day (e.g., timestamp between 01:00 and 02:00), etc.

Additionally or alternatively, the plurality of time-based map data structures may be stored (e.g., by transaction service provider system 102) on a plurality of servers. In some non-limiting embodiments, each server of the plurality of servers may store at least one of the time-based map data structures. For example, if the map data structure is divided into 24 one-hour time-based map data structures, each time-based map data structure may be stored on its own server (e.g., 24 servers, each with one time-based map data structure stored thereon).

In some non-limiting embodiments, the second portion of the transaction data may include one or more additional keys (e.g., a second key based on second aggregation of interest data, as described herein) for each transaction. The second key may be stored in association with each transaction in the time-based map data structure based on the first key (e.g., just as any other part of the second portion of the transaction data, as described herein). Additionally, the first key and the second key may be different. For example, the first key may be a compound string including the Timestamp and a first portion of the data, as described herein, and the second key may be based on a second portion of the data (that may or may not be a compound string with the Timestamp).

In some non-limiting embodiments, older data (e.g., transaction data) may be moved to a separate long-term/persistent storage, as described herein. For example, an indication of a first time period may be received (e.g., at transaction service provider system 102 from a client device). For the purpose of illustration, the first time period may be a maximum time period after which data should be moved to long-term/persistent storage (e.g., 1 day/24 hours, 1 week/7 days, or the like). A plurality of keys associated with a second time period before the first time period may be determined (e.g., keys corresponding to transactions older than 1 day/24 hours, 1 week/7 days, or the like, respectively). The second plurality of keys and the second transaction data associated with each transaction corresponding to the second plurality of keys may be stored in a long-term/persistent storage. The long-term storage may be different than the map data structure. Additionally or alternatively, the second plurality of keys and the corresponding second transaction data may be removed from the map data structure.

In some non-limiting embodiments, the raw data (e.g., raw transaction data) may be separately stored in a long-term/persistent storage. The long-term storage may be different than the map data structure. For example, if new aggregation of interest data is received, the raw data or a portion thereof may be used to determine new/additional keys for each transaction and/or as a source of an additional portion of the transaction data to be stored in the map data structure corresponding to the existing or new keys. Additionally or alternatively, the raw data may be used as a backup in the event that the map data structure becomes corrupted, unavailable, and/or the like.

As shown in FIG. 3, at step 345, process 300 may include sorting the keys. For example, the first keys associated with the plurality of payment transactions may be sorted based on the first aggregation of interest data. For example, the keys may be determined based on the first aggregation of interest data, and the keys may be sorted by an in-order insert operation.

For the purpose of illustration, in some non-limiting embodiments, transaction service provider system 102 may proactively create a sorted map data structure with keys. For example, the key may include compound string based on a first portion of the transaction data as described herein (e.g., IP:Timestamp as a key stored in a map with corresponding values for the second portions of the data, such as DeviceId, UserID, PAN, and/or the like). Using key(s) to identify each transaction provides the advantage of allowing for relatively fast and easy sorting. For example, keys may be sorted by an in-order insert operation in O(LogN) time. Additionally, after sorting, the sorted keys provide the advantage of allowing for quickly identifying the range of relevant data entries (e.g., payment transactions) in the sorted map data structure by binary searching with O(LogN) time.

In some non-limiting embodiments, if there are multiple keys for each transaction (e.g., first and second keys), each set of keys may be sorted separately. For example, second keys associated with the plurality of payment transactions may be sorted based on second aggregation of interest data (separately from the first plurality of keys being sorted based on the first aggregation of interest data).

In some non-limiting embodiments, the map data structure may be divided into a plurality of time-based map data structures, as described herein. Each time-based map data structure may be sorted, as described herein, thereby resulting in a plurality of time-based sorted map data structures.

In some non-limiting embodiments, for the purpose of illustration, time-based sorted map data structures, as described herein, may be used for efficiently transforming and storing raw event data (e.g., transaction data) to accelerate the data aggregation operations with constant time complexity. Such time-based sorted map data structures provide the advantage of reducing the data access time. For example, since each time-based sorted map data structure contains only a portion of the total number of entries (e.g., only entries for payment transactions that occurred during the time period corresponding to each time-based sorted map data structure), the number of N (e.g., the number of entries in each map data structure) is thereby reduced compared to a single map data structure for all entries. For the purpose of illustration, with a time period having a duration of one hour, the transaction data for each day may be divided into 24 one-hour time-based sorted maps, each of which may have an index. For example, the index may be key_entities_hourIndex, where hourindex is Unix time divided by the number of milliseconds in an hour. Such time-based sorted maps provide at least the following advantages. First, as described above, each time-based sorted map may have a smaller N value. Furthermore, each time-based sorted map may be further allocated to different servers for a distributed in-memory caching, as described herein, which improves the parallelism for concurrent operations and relieves the memory demands for individual servers. Additionally, depending on the time duration of interest (which may be received from/defined by the user or dynamically determined based on user requests), the time period for each time-based map data structure may be dynamically adjusted to balance between data granularity (e.g., more precise if smaller time periods) and overhead/demands on computing resources (e.g., proactively calculating and storing too many small time periods may devote excessive computing resources). Thus, time-based sorted map data structures provide the advantage of speeding up the data aggregation time, for example, time-based sorted map data structures may reduce latency.

As shown in FIG. 3, at step 347, process 300 may include determining and/or scheduling other sources of data. For example, transaction service provider system 102 (or a device thereof) may determine a set of data is stored at a plurality of sources (e.g., servers). Additionally or alternatively, a subset of the set of data may be stored at each source (e.g., each server of the plurality of servers). In some non-limiting embodiments, the user request and/or aggregation of interest data may include set identification data associated with a set of data. For example, transaction service provider system 102 (or a device thereof) may receive a first request from a client device (e.g., a device of issuer system 104, a customer device 106, a device of merchant system 108, a device of acquirer system 110, and/or another device of transaction service provider system 102), and the first request may include first aggregation of interest data associated with a type of aggregation of interest and first set identification data associated with the first set of data. Based thereon, transaction service provider system 102 (or a device thereof) may determine the first set of data is stored at a plurality of servers, wherein a first subset of the first set of data is stored at each server of the plurality of servers. In some non-limiting embodiments, the plurality of servers may be devices of transaction service provider system 102. In some non-limiting embodiments, at least some of the plurality of servers may be devices of another system, another device, another group of systems, or another group of devices separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

As shown in FIG. 3, at step 350, process 300 may include calculating aggregation values for predetermined time periods. For example, based on the type of aggregation of interest, there may be at least one time duration of interest, and aggregation values for each complete time period having a time duration equal to at least one of the time duration(s) of interest may be determined. For the purpose of illustration, for at least one time duration of interest (e.g., one hour, one day, and/or the like), aggregations for each time period of that duration (e.g., each one-hour period, each one-day period, and/or the like) may be determined.

In some non-limiting embodiments, the map data structure may be divided into a plurality of time-based map data structures stored on a plurality of servers, as described herein. For example, each server may calculate a value of the aggregation(s) of interest based on at least one of the plurality of keys and the corresponding second portion of the transaction data associated with each transaction of the subset of the payment transactions stored thereon. Additionally, each server may store the value(s) of such aggregation(s). In some non-limiting embodiments, if a user request for a particular aggregation that spans multiple predetermined time periods is received, the final value of the aggregation may be determined based on the values of the aggregations for the predetermined time periods stored on each server within the time period of the requested aggregation. Additionally or alternatively, if some portion of the requested time period does not correspond to a complete predetermined time period, the key(s) and/or corresponding second portion of the transaction data corresponding to transactions within that portion of the requested time period may be used to determine the partial aggregation for that portion of the requested time period, and the final value of the aggregation may be determined based on the value of the partial aggregation and the values of the aggregations for the predetermined time periods stored on each server within the time period of the requested aggregation.

In some non-limiting embodiments, for the purpose of illustration, a time-based sorted map data structure provides the advantage of speeding up the data aggregation time, for example, by reducing latency, as described herein. Additionally, proactively calculating some aggregations (e.g., the value of aggregation(s) for each of the time-based map data structures, as described herein) provides the advantage of speeding up aggregation time and the advantage of balancing latency (e.g., faster aggregation times when more aggregations are proactively calculated) with overhead/demands on computational resources (e.g., proactively calculating and storing too many small time periods may require excessive computing resources). For example, when a user request for an aggregation is received, the aggregation values for each of the predetermined time periods (e.g., from each of the time-based sorted map data structures) may be used for determining a portion of the final value of the requested aggregation (without re-evaluating the keys/data in such time-based sorted map data structures) and only the portion of the requested aggregation that is outside of the predetermined time periods (e.g., not a complete predetermined time period) must be evaluated (e.g., searched to identify relevant keys to then separately calculate the portion of the aggregation), thereby limiting the event level (e.g., individual transaction data entries) to be evaluated to generate the final aggregation value. As such, the computational complexity of aggregation computations may approach O(1) constant time. For example, to answer an aggregation request such as “What is the sum of purchase amounts associated with the IP address 10.1.2.3 in the past 5 hours?” at 6:30 AM (assuming one-hour predetermined time periods), the final aggregation value may be determined based on the sum of predetermined aggregation values (e.g., predetermined total purchase amount) from each time-based sorted map data structure corresponding to the one-hour periods from 02:00-06:00 added to purchase amount values identified for the (ad-hoc) periods of 1:30-2:00 and 6:00-6:30 to create the final aggregation result.

In some non-limiting embodiments, a first set of aggregation values based on the transaction data associated with a first subset of the plurality of transactions associated with each of a plurality of first predetermined time periods may be calculated, and a second set of aggregation values based on the transaction data associated with a second subset of the plurality of transactions associated with each of a plurality of second predetermined time periods may be calculated. Additionally, a user request for a desired aggregation may include time period data associated with a first time period of interest. Based thereon, an intermediate value based on a first plurality of first keys associated with a third subset of the plurality of payment transactions may be calculated, wherein the third subset of the plurality of transactions is associated with a portion of the first time period of interest outside of the plurality of first predetermined time periods and the plurality of second predetermined time periods. The final value of the requested aggregation may be based on a subset of the first set of aggregation values within the first time period of interest, a subset of the second set of aggregation values within the first time period of interest, and the intermediate value. For example, the first predetermined time periods may each have a first duration and the second predetermined time periods may each have a second duration greater than the first duration. For the purpose of illustration, the first duration may be an hour and the second duration may be a day. Additionally, the subset of the second set of aggregation values may be associated with complete second predetermined time periods (e.g., complete days) within the first time period of interest, the subset of the first set of aggregation values may be associated with complete first predetermined time periods (e.g., complete hours) within a remaining portion of the first time period of interest (e.g., a first portion of the time period of interest outside of a second portion of the time period of interest corresponding to the subset of the second set of aggregation values), and the intermediate value may be determined/calculated based entries (e.g., transactions) corresponding to keys associated with entries (e.g., transactions) within the portion of the time period of interest that does not correspond to complete first and/or second predetermined time periods (e.g., a third portion of the time period of interest outside of the first portion and the second portion).

In some non-limiting embodiments, data may be stored at a plurality of sources. Additionally or alternatively, each source (e.g., server) may be instructed to determine at least one subset value associated with the type(s) of aggregation(s) of interest for the respective subset of the data stored thereon. For example, transaction service provider system 102 (or a device thereof) may instruct each source (e.g., server) to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon. In some non-limiting embodiments, each source may be a device (e.g., server) of transaction service provider system 102. Additionally or alternatively, at least some of the sources may be a device (e.g., server) of another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, parallelization (e.g., allow for distributed storing at multiple servers and/or distributed processing at multiple servers simultaneously) may be improved by storing data and/or determining subset values at a plurality of sources. For example, aggregations may be performed on multiple data sources in parallel. In some non-limiting embodiments, a distributed scheduler may instruct each source (e.g., server) to determine the subset value(s) as part of a scheduled job at the respective source (e.g., server). In some non-limiting embodiments, the distributed scheduler may be a device of transaction service provider system 102. Additionally or alternatively, the distributed scheduler may be implemented (e.g., completely, partially, and/or the like) by another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110). For the purpose of illustration, a distributed scheduler may schedule jobs (e.g., tasks, commands, and/or the like) on at least some of the sources to determine at least one subset value (e.g., value(s) to be used for an aggregation) for a first period/term (e.g., term 1: hourly). Additionally or alternatively, the distributed scheduler may schedule jobs (e.g., tasks, commands, and/or the like) on at least some of the sources to determine at least one subset value (e.g., value(s) to be used for an aggregation) for a second period/term (e.g., term 2: daily). In some non-limiting embodiments, the scheduled jobs can get data from any less expensive, longer-term, and/or lower performing data sources (e.g., Hadoop, legacy relational databases, Structured Query Language (SQL) databases, non-SQL (NoSQL) databases, and/or the like). In some non-limiting embodiments, a higher performing and/or more expensive data source (e.g., cache memory such as Redis, Hazelcast, Apache Ignite, and/or the like) may be updated with the subset values.

In some non-limiting embodiments, the subset values may be received from each source (e.g., server). For example, transaction service provider system 102 (or a device thereof) may receive the subset values from each source. In some non-limiting embodiments, each source may be a device (e.g., server) of transaction service provider system 102. Additionally or alternatively, at least some of the sources may be a device (e.g., server) of another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, an aggregation value may be determined based on combining the subset value(s) from each source (e.g., server). For example, transaction service provider system 102 (or a device thereof) may determine the aggregation value based on combining the subset value(s) from each source (e.g., server). For the purpose of illustration, transaction service provider system 102 may include an aggregation engine, which may be configured to combine the subset values from multiple data sources to get the aggregation data. The subset values may be combined by any suitable mathematical technique, as described herein. In some non-limiting embodiments, the aggregation engine may be implemented (e.g., completely, partially, and/or the like) by a higher performing and/or more expensive data source (e.g., a high-performance caching system such as Redis, Hazelcast, Apache Ignite, and/or the like).

In some non-limiting embodiments, the set of data may include first payment transaction data associated with a plurality of payment transactions during a first period. Additionally or alternatively, the user request may include second payment transaction data associated with a payment transaction. In some non-limiting embodiments, the aggregation(s) performed (e.g., aggregation(s) of interest) may be context-based. For example, if the amount of the payment transaction is larger than certain amount (e.g., a threshold), a first set of aggregations may be performed; otherwise, a second set of aggregations (e.g., less aggregations, less computationally expensive aggregations, aggregations using less data, and/or the like) may be performed. For the purpose of illustration, if the second transaction data may include a transaction amount of the payment transaction, and a first type of aggregation of interest may include a first set of aggregations if the transaction amount is above a threshold and a second set of aggregations if the transaction amount is below the threshold. Additionally or alternatively, if the internet protocol (IP) address associated with the payment transaction has a bad reputation, one set of aggregations may be performed; otherwise, another set of aggregations (e.g., less aggregations, less computationally expensive aggregations, aggregations using less data, and/or the like) may be performed. For the purpose of illustration, the second transaction data may include the IP address associated with the payment transaction, and the first type of aggregation of interest may include a first set of aggregations if the IP address is disreputable and a second set of aggregations if the IP address is reputable (or not disreputable). In some embodiments, context-based aggregations may improve performance and/or reduce the usage of computational resources since more computationally expensive (e.g., large) sets of aggregations may not be performed for every transaction, and/or less computationally expensive aggregations may be performed for some transactions.

As shown in FIG. 3, at step 360, process 300 may include communicating at least one value of at least one aggregation based on a user request. Each value may be based (at least partially) on a plurality of the keys associated with a subset of the plurality of payment transactions based on the user request. Additionally or alternatively, the first value may further be based on the second portion of the transaction data associated with each of the first keys associated with the subset of payment transactions. For example, the final value of a requested aggregation may be communicated (e.g., from transaction service provider system 102 to a client device from which the request was received) after the final value of the aggregation is determined/calculated, as described herein.

In some non-limiting embodiments, a first user request may be received (e.g., at transaction service provider system 102) from a user client (e.g., a client device), and the user request may include a request for a value based on (first) aggregation of interest data associated with the type of aggregation of interest and time period data associated with a first time period of interest. A plurality of the keys may be identified based on the first aggregation of interest data and the time period data. For example, keys corresponding to transactions in the time period of interest having at least one attribute relevant to the aggregation of interest may be identified, as described herein. The value may be calculated based on the keys and/or the second portion of the transaction data associated with the keys, as described herein. That value may then be communicated to the user client, as described herein.

In some non-limiting embodiments, the data may be divided into time-based sorted map data structures stored on separate servers, as described herein. Additionally or alternatively, intermediate aggregation values may be determined for each of a plurality of predetermined time periods, as described herein. In some non-limiting embodiments, in response to receiving a user request with a time period of interest, a plurality of intermediate values from respective predetermined periods within the time period of interest may be communicated as well as the value of an (ad-hoc) aggregation for transactions within the time period of interest that are outside of the predetermined time periods, as described herein. For purpose of illustration, to answer an aggregation request such as “What is the sum of purchase amounts associated with the IP address 10.1.2.3 in the past 5 hours?” at 6:30 AM (assuming one-hour predetermined time periods), intermediate predetermined aggregation values (e.g., predetermined total purchase amount) from each time-based sorted map data structures corresponding to the one-hour periods from 02:00-06:00 may be transmitted, and sum of the purchase amount values identified for the (ad-hoc) periods of 1:30-2:00 and 6:00-6:30 may also transmitted, and the device that receives the transmissions (e.g., a user client) may add the intermediate predetermined values with the sum to create the final aggregation result.

In some non-limiting embodiments, data may be stored at a plurality of sources. Additionally or alternatively, transaction service provider system 102 may communicate an aggregation value to the user client based on subset values from the different sources. In some non-limiting embodiments, the aggregation value (e.g., a first aggregation value) may have been determined based on combining subset values (e.g., the at least one first subset value) from each source (e.g., server), as described herein.

In some non-limiting embodiments, a transaction may be evaluated based on the aggregation(s) communicated. For example, the value may be representative of historical information associated with the various attributes of the transaction. For the purpose of illustration, many previous valid transactions from the same device (e.g., same DeviceID and/or same IP address) may indicate a new transaction from that same device is unlikely (or less likely) to be fraudulent. In contrast, many declined transactions and/or failed login attempts from an unknown device may indicate a new transaction from that same device is likely (or more likely) to be fraudulent (e.g., an attack by a third party). Decision/scoring systems (e.g., risk scoring systems) may process many requests very quickly (e.g., millions per day and/or thousands per second), so it may be useful for data representing historical activities to be aggregated on demand efficiently and quickly for effective use in various decision/scoring models (e.g., risk scoring models). For example, to detect a potentially fraudulent transaction, aggregations may be used to determine a number of PANs related to an IP address in various time periods (e.g., past 10 seconds, 1 minute, 1 hour, etc.), a number of unique IP addresses associated with a particular PAN in various time periods, a total transaction amount for a particular PAN in various time periods, a maximum risk score and/or a minimum risk score associated with a particular PAN in various time periods, a number of distinct account identifiers associated with a particular device identifier in various time periods, and/or the like.

In some non-limiting embodiments, computations (e.g., determining and/or calculating the value of the requested aggregation) may be performed at the system/device (e.g., server of transaction service provider system 102) where data is stored, and only the requests (identifying the type/time period of aggregation(s) desired) and final values of the aggregations are communicated, rather than communicating the data itself (or results of intermediate calculations determined thereon), all of which provide the advantage of reducing the computation latencies that may otherwise be problematic in distributed computing environments. For example, Apache Spark may improve the performance of Hadoop by putting data in memory, but large amounts of data may still be transferred from servers to servers to generate final outputs. In contrast, in some non-limiting embodiments, the disclosed subject matter not only stores transaction data in a distributed in-memory cache but also communicates computational tasks (e.g., requests for aggregations) to the data instead of moving data within the network. In some non-limiting embodiments, the disclosed subject matter may therefore achieve reduced latency (e.g., less than 10 ms, 2 ms, 1 ms, less than 1 ms, etc.) on average for individual requests that may contain over 200 concurrent aggregations of a single payment transaction.

For the purpose of illustration, in some traditional data pulling-based designs, an aggregation client may (e.g., based on a specific aggregation task) derive keys, indices, and/or the like to retrieve the relevant data from remote servers, and after the data is transferred, then the necessary computations to generate final aggregation results may be performed. However, under such techniques, while the system may quickly identify the relevant data in the memory on remote servers, the cost of retrieving/transferring data from remote servers accumulates to increase aggregation latency significantly. In contrast, according to some non-limiting embodiments of the disclosed subject matter, advantages of increased efficiency may be gained by in-memory data computation (e.g., performing computation at server(s) where data is stored) and communicating requests (e.g., with identifiers of the requested aggregation tasks) to the relevant data (rather than transferring the data). For an aggregation task, according to some non-limiting embodiments of the disclosed subject matter, keys for each data entry (e.g., payment transaction) may be determined, but instead of retrieving the data from remote servers, servers storing relevant portions of the data (e.g., time-based sorted map data structures) may be instructed to compute aggregations using local in-memory data to create the intermediate results, and intermediate results may be collected to compute the final aggregation results (or the intermediate results may be communicated to the requesting device, which can compute the final aggregation result quickly therefrom). Accordingly, network activities may be reduced, for example, by only transmitting requests for an aggregation task and the intermediate/final value of the aggregation, which have much smaller volumes of data transfer and therefore reduce network latency.

In some non-limiting embodiments, the techniques and systems described herein improve storage schema (e.g., improve efficiency of storing data and reduce latency in identifying relevant entries), improve allocation of computing resources and network resources (e.g., compute aggregations directly where the data is stored and communicate only final values), improve parallelization (e.g., allow for distributed storing at multiple servers and/or distributed processing at multiple servers simultaneously), and provide the advantage of low latency and high throughput without overburdening computing resources. For example, the techniques and systems described herein may allow average latency for over tens of thousands concurrent aggregations in less than 10 ms (e.g., 1-2 ms or even less than 1 ms).

For the purpose of illustration, in some non-limiting embodiments, the values of the requested aggregations may be useful in any suitable application for which historical information, trend information, and/or statistical information may be desired. For example, when a customer is making a purchase, the customer may initiate a payment transaction. The payment transaction may be communicated to a risk scoring engine (e.g., a computer system that uses at least one scoring model to evaluate the risk of fraud in a transaction), which, for example, may be a part of transaction service provider system 102, issuer system 104, merchant system 108, and/or acquirer system 110. The scoring engine may request one or more aggregations, the values of which may be variables in its risk models. An aggregation engine (e.g., a computer system configured to perform process 300 completely or partially) may provide the values of the requested aggregations, as described herein. The scoring engine may generate a risk score based on aggregation data (e.g., use the aggregation values as input for its scoring model(s)). Based on the risk score, the transaction may be approved (e.g., if the risk score is below a threshold) or denied (e.g., if the risk score is above a threshold). In some non-limiting embodiments, a risk score for an incoming transaction may rely on various aggregation values such as PAN usage count, total transaction amount, and/or the like, some of which may be time-window based (e.g., in the past 5 minutes, 1 hour, 1 day, 1 week, 1 month, etc.), and aggregations for each time window may be calculated with low latency (e.g., within a few milliseconds, as described herein) in order to be available quickly enough to flag a transaction while the transaction is being processed/authorized.

In some non-limiting embodiments, the techniques and systems described herein may be applied for other types of events, messages, and/or interactions involving any device(s), system(s), network(s), and/or combinations thereof, even if unrelated to payment transactions. For the purpose of illustration, a proprietor of a website may receive event data associated with a plurality of click events. For example, each click may be associated with particular content that is clicked (e.g., advertisement images, product images, article text, video frames, and/or any other suitable piece of information displayed visually). Values of aggregations related to click events may represent popularity of the content clicked. For example, if the content is a product image, aggregation information related to click events associated therewith may represent popularity of the product, which the proprietor of the website may use to evaluate and/or automate product management decisions (e.g., ordering more stock of popular items or ordering less stock of unpopular items). Additionally or alternatively, a merchant with locations spread out in various areas of the country may use event data aggregation (e.g., click data, as described above, in-store inventory data, and/or the like) to proactively move products closer to regions where they are more popular or even move an individual product to a location closer to an individual customer, for example, to reduce shipping time. In some non-limiting embodiments, service providers (e.g., analytics agencies, credit reporting agencies, investigative agencies, and/or the like) may use aggregations to produce reports on various metrics (e.g., distribution of credit scores of different age groups) or use aggregations to determine values of variables for scoring models. In some non-limiting embodiments, aggregation values may be used as inputs in any other suitable setting, e.g., real-time analytics, marketing, advertisement, machine learning, and/or the like.

Referring now to FIG. 4, FIG. 4 is a diagram of an overview of a non-limiting embodiment of an implementation 400 relating to process 300 shown in FIG. 3. As shown in FIG. 4, implementation 400 includes aggregation engine 402. Aggregation engine 402 may be the same as or similar to transaction service provider system 102. Additionally or alternatively, aggregation engine 402 may be configured to perform (e.g., completely, partially, and/or the like) process 300. In some non-limiting embodiments, aggregation engine 402 may receive data (e.g., transaction data associated with a plurality of transactions), as described herein. Additionally or alternatively, aggregation engine 402 may determine at least one key for each data entry (e.g., each transaction of the plurality of transactions), as described herein. For example, aggregation engine 402 may determine m keys for each transaction (where m is the number of keys), and each key may be based on at least one aggregation of interest identified in aggregation of interest data.

Referring now to FIG. 5, FIG. 5 is a diagram of an overview of a non-limiting embodiment of an implementation 500 relating to process 300 shown in FIG. 3. As shown in FIG. 5, implementation 500 may include at least one data source 502 a, at least one configuration file 502 b, at least one stream processor 502 c, at least one cache/database 502 d, at least one aggregator 502 e, at least one long-term aggregator 502 f, at least one long-term database 502 g, and at least one client device 508. For example, data source 502 a, configuration file 502 b, stream processor 502 c, cache/database 502 d, aggregator 502 e, long-term aggregator 502 f, and long-term database 502 g may be the same as or similar to devices and/or portions of transaction service provider system 102, as described herein. In some non-limiting embodiments, client device 508 may be the same as or similar to a device and/or portion of merchant system 108. Additionally or alternatively, client device 508 may be the same as or similar to a device of issuer system 104, a customer device 106, a device of acquirer system 110, and/or another device of transaction service provider system 102.

In some non-limiting embodiments, implementation 500 may employ Lambda architecture (e.g., combination of cache/high-speed storage for recent/real-time data in cache/database 502 d and persistent/batch storage for older/cold data in long-term database 502 g) and microservices architecture (e.g., separate, independently deployable modules, such as data source 502 a, configuration file 502 b, stream processor 502 c, cache/database 502 d, aggregator 502 e, long-term aggregator 502 f, and/or long-term database 502 g), either or both of which may provide advantages of a complete, flexible, and dynamic framework to support various data aggregations, as described herein. In some non-limiting embodiments, Lambda architecture may take advantage of both batch and streaming processing, where data for and aggregations within the most recent 24 hours may be stored and/or processed by the real-time component (e.g., cache/database 502 d), while data and aggregations for the period before the most recent 24 hours (e.g., from days to years in the past) may be stored and/or processed by a batch aggregation engine (e.g., long-term aggregator 502 f).

In some non-limiting embodiments, the data source(s) 502 a may be streams and/or messages directly from an electronic payment network, as described herein. Additionally or alternatively, at least one data source 502 a may be a database, an API coupled to another device and/or system, and/or a messaging cluster, as described herein. For example, data source(s) 502 a may include various data source connectors such as Kafka consumers, Hadoop/HDFS data readers, and/or the like to retrieve raw data.

In some non-limiting embodiments, configuration file 502 b may be received from a client device (e.g., client device 508), and the configuration file may include aggregation of interest data, as described herein. Additionally or alternatively, an initial and/or default configuration file may be provided with initial and/or default aggregation of interest data.

In some non-limiting embodiments, each stream processor 502 c may act as a data ingestion service. For example, stream processor(s) 502 c may determine one or more keys for each data entry (e.g., payment transaction), as described herein. Additionally or alternatively, stream processor(s) 502 c may filter and/or encrypt the data or portions thereof, as described herein. For example, for the data filtering, relevant fields may be determined based on configuration files, user requests, and/or other user inputs and other (e.g., non-relevant) fields may be filtered out, as described herein. Additionally, to handle sensitive/private data, sensitive/private fields may be determined based on configuration files, user requests, and/or other user inputs, and such fields may be encrypted (and any fields not so designated may remain in clear text/transparent), as described herein. In some non-limiting embodiments, stream processor 502 c may sort the key(s), as described herein.

The key(s) for each data entry (e.g., payment transaction) and, optionally, the corresponding second/remaining portion of the data for each data entry may be stored in the cache/database 502 d, as described herein. For example, the cache/database 502 d may include at least one server, and the keys/data may be stored in time-based sorted map data structures, as described herein. In some non-limiting embodiments, to reduce aggregation delay, reduce data access latency, provide flexibility/configurability, improve system performance, improve scalability, and/or provide higher availability, the cache database 502 d may include a pluggable interface for different distributed in-memory caching systems/techniques (e.g., Redis, Hazelcast, Apache Ignite, and/or the like).

In some non-limiting embodiments, aggregator 502 e may determine and/or communicate the value of a requested aggregation to the requesting client device (e.g., client device 508), as described herein. Additionally or alternatively, a plurality of aggregators 502 e (e.g., on a plurality of servers, as described herein) may each provide an intermediate aggregation value (e.g., values for predetermined portions/time periods of data and/or values of portions/time periods of data outside of predetermined periods) and communicate the intermediate aggregation values to the client (e.g., client device 508) to combine/process the intermediate aggregation values to determine the final aggregation value, as described herein. In some non-limiting embodiments, the aggregators 502 e may leverage on the data locality, thereby reducing network activity for the aggregation calculation and directly perform aggregations on the local in-memory data for the underlying distributed in-memory caching systems, as described herein.

In some non-limiting embodiments, long-term aggregator 502 f may perform aggregations on older data that is stored in (or moved to) long-term database 502 g. For example, while cache/database 502 d and aggregators 502 e may be used for aggregations for real-time/recent data and be selected/configured for low latency for critical/urgent short-term aggregations, the long-term aggregator 502 f may be selected/configured for providing diverse (in terms of functions, complexity, and time scale) aggregations that are less critical/urgent. For example, long-term aggregator 502 f may operate on a batch cycle (e.g., hourly, daily, and/or the like). Implementation 500 may therefore combine short-term/real-time aggregations with longer-term/batch aggregations in a single interface/implementation to support various decision making queries.

In some non-limiting embodiments, older event data (e.g., transaction data) may be stored on or moved to long-term database 502 g, which may be a persistent database separate from the cache/database 502 d, as described herein. Additionally or alternatively, raw, preprocessed event data (e.g., transaction data) and/or or post-processed event data may be stored in the long-term database 502 g for the purpose of faster cache data recovery (e.g., backup) and/or as a source of new/additional keys and/or as a source of an additional portion of the transaction data to be stored in the map data structure based on new aggregation of interest data, as described herein. Additionally or alternatively, the data in long-term database 502 g may be used for opportunistic further data preprocessing for complex aggregations.

In some non-limiting embodiments, client device 508 may be one or more client devices, as described herein. For example, client device 508 may be a device of merchant system 108. Additionally or alternatively, client device 508 may be a device of issuer system 104, a customer device 106, a device of acquirer system 110, and/or another device of transaction service provider system 102.

Referring now to FIG. 6, FIG. 6 is a diagram of an overview of a non-limiting embodiment of an implementation 600 relating to process 300 shown in FIG. 3. As shown in FIG. 6, implementation 600 may include at least one client device 608, at least one cache/database 602 d, and/or at least one aggregator 602 e. In some non-limiting embodiments, client device 608 may be the same as or similar to the client device 508, as described herein. In some non-limiting embodiments, each cache/database 602 d may be the same as or similar to cache/database 502 d, as described herein. In some non-limiting embodiments, aggregator 602 e may be the same as or similar to aggregator 502 e, as described herein.

In some non-limiting embodiments, as shown in FIG. 6, the client device 608 may send a request (e.g., “executeOnKey(key1, agg),” “executeOnKey(key2, agg),” “executeOnKey(key3, agg),” etc.) identifying a requested aggregation (e.g., based on the content of the field “agg”), as described herein. Additionally or alternatively, if the event data (e.g., transaction data) is stored on multiple servers, the request may further include information identifying the key or range of keys (e.g., based on the content of the fields “key1,” “key2, “key3,” etc.) for each server. In some non-limiting embodiments, aggregator 602 e may determine/calculate the value of the aggregation (or an intermediate value thereof based on the information stored on that particular server), as described herein. Additionally or alternatively, aggregator 602 e may communicate the value of the aggregation (or the intermediate value thereof) to the client device 608, as described herein.

Referring now to FIG. 7, FIG. 7 is a diagram of an overview of a non-limiting embodiment of an implementation 700 relating to process 300 shown in FIG. 3. As shown in FIG. 7, implementation 700 may include messaging cluster 702 a, ingestion service 702 c, cache 702 d, aggregator 702 e, scoring platform 702 h, and/or client device 708. In some non-limiting embodiments, messaging cluster 702 a may be the same as or similar to data source 502 a. Additionally or alternatively, messaging cluster 702 a may be any suitable messaging cluster and/or data source connector, as described herein. In some non-limiting embodiments, ingestion service 702 c may be the same as or similar to stream processor 502 c. In some non-limiting embodiments, cache 702 d may be the same as or similar to cache/database 502 d. In some non-limiting embodiments, aggregator 702 e may be the same as or similar to aggregator 502 e. In some non-limiting embodiments, client device 708 may be the same as or similar to client device 508.

In some non-limiting embodiments, messaging cluster 702 a may provide streams and/or messages to be received by the ingestion service 702 c, as described herein. For example, messaging cluster 702 a may include various data source connectors such as Kafka consumers, Hadoop/HDFS data readers, and/or the like to retrieve raw data and provide such data to the ingestion service 702 c.

In some non-limiting embodiments, ingestion service 702 c may determine one or more keys for each data entry (e.g., payment transaction), as described herein. Additionally or alternatively, ingestion service 702 c may filter and/or encrypt the data (or portions thereof), as described herein. In some non-limiting embodiments, ingestion service 702 c may sort the key(s), as described herein. In some non-limiting embodiments, ingestion service 702 c may also proactively update aggregations for current predetermined time periods (e.g., hourly, daily, and/or the like) stored in the cache 702 d, as described herein.

The key(s) for each data entry (e.g., payment transaction) and, optionally, the corresponding second/remaining portion of the data for each data entry may be stored in the cache 702 d, as described herein. Additionally or alternatively, aggregation values for predetermined periods (e.g., first and second predetermined periods) may be stored in the cache 702 d. For example, as shown in FIG. 7, the first predetermined period may be one hour and the second predetermined period may be one day, as described herein. In some non-limiting embodiments, hourly and daily aggregations may be stored in cache 702 d, as described herein.

In some non-limiting embodiments, aggregator 702 e may determine and/or communicate the value of a requested aggregation to the requesting device (e.g., scoring platform 702 h), as described herein.

In some non-limiting embodiments, scoring platform 702 h may be a scoring engine or any device/system having a scoring model, as described herein. For example, scoring platform 702 h may be a part of transaction service provider system 102. Additionally or alternatively, scoring platform may be a part of issuer system 104, merchant system 108, and/or acquirer system 110. The scoring platform 702 h may request one or more aggregations, the values of which may be inputs for variables in its scoring models, as described herein. Based on the risk score, the transaction may be approved (e.g., if the risk score is below a threshold) or denied (e.g., if the risk score is above a threshold).

In some non-limiting embodiments, client device 708 may be one or more client devices, as described herein. For example, client device 708 may be a device of transaction service provider system 102. Additionally or alternatively, client device 708 may be a device of issuer system 104, a customer device 106, a device of merchant system 108, and/or a device of acquirer system 110.

Referring now to FIG. 8, FIG. 8 is a diagram of an overview of a non-limiting embodiment of an aggregation 800 relating to process 300 shown in FIG. 3. For example, a request for an aggregation may indicate a time period of interest of 1 week, e.g., the 7-day period looking back from the current time (e.g., a current time of 10:30:33:345 GMT), and predetermined calculations may be calculated for each first time period (e.g., hourly) and each second time period (e.g., daily). For purpose of illustration, for the current day (Day 0), aggregations for the day and the current hour may be updated for each transaction during the day and hour, respectively. At the end of the respective time period (e.g., end of the current day or end of the current hour), the complete aggregation for that time period may be stored and a new aggregation may be created for the now-current time period (e.g., the next day or next hour, respectively). Thus, upon receipt of the request for the aggregation, the daily aggregation for the current day (Day 0) up to the current time is already stored and therefore available. Additionally, the daily aggregations for the previous full days in the period (Day −1 to Day −6) are also already stored and therefore available. For the portion of the day at the beginning of the period (Day −7), hourly aggregations are also already stored and therefore available for each complete hour within the portion of that day (Day −7). In addition, the intermediate aggregation value for the portion of the time period of interest between the current time (e.g., 10:30:33:345 GMT) and the next full hour (e.g., 11:00:00:000 GMT) may be calculated based on the keys and/or remaining portions of the event data (e.g., transaction data) corresponding to events (e.g., transactions) in that portion of the time period, as described herein. Thus, as shown in FIG. 8, the key/data may be used to determine the aggregation for the period from 10:30:33:345 GMT to 10:50:59:000 GMT (e.g., just before the next hour starting at 11:00:00:00 GMT), hourly aggregations may be used for the time period from 11:00:00:000 GMT to the of the day at the beginning of the period (Day −7), and daily aggregations may be used for the remaining days (full days Day −6 to Day −1 and partial Day 0). The final aggregation value may be obtained by combining the key/data aggregation, hourly aggregations, and daily aggregations. Additionally, in some non-limiting embodiments, the key/data aggregation, hourly aggregations, and daily aggregations may all be determined/retrieved in parallel.

In some non-limiting embodiments, the techniques of the disclosed subject matter may provide the advantages of extremely low aggregation latency, high throughput, high availability, and scalability, all of which may be due, at least in part, to the data structures described herein, efficient storage, sorting, and determination of aggregations described herein, efficient use of computing and network resources described herein, and/or parallelization described herein. In some non-limiting embodiments, the techniques of the disclosed subject matter may be used to determine complex aggregations, combinations of aggregations, various stream joins, and/or the like, and may further allow users to add their own customized aggregation functions. In some non-limiting embodiments, the techniques described herein may be used in either or both of SQL and non-SQL databases.

Referring now to FIG. 9, FIG. 9 is a diagram of an overview of a non-limiting embodiment of an implementation 900 relating to process 300 shown in FIG. 3. As shown in FIG. 9, implementation 900 may include client device 908, data sources 902 a, and/or aggregation engine 902 e. In some non-limiting embodiments, client device 908 may be the same as or similar to client device 508, client device 608, and/or client device 708. Additionally or alternatively, client device 908 may be the same as or similar to one or more client devices, as described herein. For example, client device 908 may be the same as or similar to a device of transaction service provider system 102. Additionally or alternatively, client device 908 may be implemented (e.g., completely, partially, and/or the like) by a device of issuer system 104, a customer device 106, a device of merchant system 108, and/or a device of acquirer system 110.

In some non-limiting embodiments, data sources 902 a may be the same as or similar to data sources 502 a and/or messaging cluster 702 a. Additionally or alternatively, at least some of data sources 902 a (e.g. Data Sources 2-n) may be the same as or similar to long-term database 502 g. Additionally or alternatively, data sources 902 a may be any suitable messaging cluster and/or data source connector, as described herein. In some non-limiting embodiments, data sources 902 a may be devices (e.g. servers) of transaction service provider system 102. Additionally or alternatively, at least some data sources 902 a may be devices (e.g., servers) of another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, aggregation engine 902 e may be the same as or similar to aggregation engine 402, aggregator 502 e, aggregator 602 e, and/or aggregator 702 e. Additionally or alternatively, aggregation engine 902 e may be any suitable aggregator, as described herein. In some non-limiting embodiments, aggregation engine 902 e may be implemented by transaction service provider system 102. Additionally or alternatively, aggregation engine 902 e may be implemented by (e.g., completely, partially, and/or the like) another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110). Additionally or alternatively, aggregation engine 902 e may be configured to perform (e.g., completely, partially, and/or the like) process 300.

For the purpose of illustration, aggregation engine 902 e may receive, from client device 908, a request comprising aggregation of interest data associated with a type of aggregation of interest and set identification data associated with a set of data, as described herein. For example, client device 908 may communicate (e.g., transmit) the request based on user input to aggregation engine 902 e (e.g., a request processor of aggregation engine 902 e). Additionally or alternatively, aggregation engine 902 e (e.g., a request processor of aggregation engine 902 e) may determine the set of data is stored at a plurality of data sources 902 a, as described herein. For example, a subset of the set of data may be stored at each data source 902 a. Additionally or alternatively, aggregation engine 902 e (e.g., a request processor of aggregation engine 902 e) may instruct each data source 902 a to determine at least one subset value associated with the type of aggregation of interest for the respective subset of the set of data stored thereon, as described herein. For example, each data source 902 a may determine the subset value(s) associated with the type of aggregation of interest for the respective subset of the set of data stored thereon. Additionally or alternatively, aggregation engine 902 e (e.g., a result processor of aggregation engine 902 e) may receive the subset value(s) from each data source 902 a, as described herein. For example, each data source 902 a may communicate (e.g., transmit) the subset value(s) to aggregation engine 902 e (e.g., a result processor of aggregation engine 902 e). Additionally or alternatively, aggregation engine 902 e (e.g., a result processor of aggregation engine 902 e) may determine a aggregation value based on combining the at least one subset value from each data source 902 a, as described herein. Additionally or alternatively, aggregation engine 902 e (e.g., a result processor of aggregation engine 902 e) may communicate the aggregation value to client device 908, as described herein. For example, client device 908 may receive the aggregation value and/or present (e.g., display) the aggregation value to the user.

Referring now to FIG. 10, FIG. 10 is a diagram of an overview of a non-limiting embodiment of an implementation 1000 relating to process 300 shown in FIG. 3. As shown in FIG. 10, implementation 1000 may include client device 1008, messaging cluster 1002 a, ingestion service 1002 c, cache 1002 d, aggregator engine 1002 e, distributed scheduler 1002 f, data sources 1002 g, and/or scoring platform 1002 h. In some non-limiting embodiments, client device 1008 may be the same as or similar to client device 508, client device 608, client device 708, and/or client device 908. Additionally or alternatively, client device 908 may be the same as or similar to one or more client devices, as described herein. For example, client device 908 may be the same as or similar to a device of transaction service provider system 102. Additionally or alternatively, client device 908 may be implemented (e.g., completely, partially, and/or the like) by a device of issuer system 104, a customer device 106, a device of merchant system 108, and/or a device of acquirer system 110.

In some non-limiting embodiments, messaging cluster 1002 a may be the same as or similar to data source 502 a, messaging cluster 702 a, and/or data source 902 a. In some non-limiting embodiments, messaging cluster 1002 a may be implemented by transaction service provider system 102. Additionally or alternatively, messaging cluster 1002 a may be implemented by (e.g., completely, partially, and/or the like) another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, ingestion service 1002 c may be the same as or similar to stream processor 502 c and/or ingestion service 702 c. In some non-limiting embodiments, ingestion service 1002 c may be implemented by transaction service provider system 102. Additionally or alternatively, ingestion service 1002 c may be implemented by (e.g., completely, partially, and/or the like) another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, cache 1002 d may be the same as or similar to cache/database 502 d and/or cache 702 d. In some non-limiting embodiments, cache 1002 d may be implemented by transaction service provider system 102. Additionally or alternatively, cache 702d may be implemented by (e.g., completely, partially, and/or the like) another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, aggregator engine 1002 e may be the same as or similar to aggregation engine 402, aggregator 502 e, aggregator 602 e, aggregator 702 e, and/or aggregation engine 902 e. Additionally or alternatively, aggregator engine 1002 e may be any suitable aggregator, as described herein. In some non-limiting embodiments, aggregator engine 1002 e may be implemented by transaction service provider system 102. Additionally or alternatively, aggregator engine 1002 e may be implemented by (e.g., completely, partially, and/or the like) another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110). Additionally or alternatively, aggregator engine 1002 e may be configured to perform (e.g., completely, partially, and/or the like) process 300.

In some non-limiting embodiments, distributed scheduler 1002 f may be the same as or similar to long-term aggregator 502 f. Additionally or alternatively, distributed scheduler 1002 f may be part of aggregator engine 1002 e. In some non-limiting embodiments, distributed scheduler 1002 f may be implemented by transaction service provider system 102. Additionally or alternatively, distributed scheduler 1002 f may be implemented by (e.g., completely, partially, and/or the like) another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, data sources 1002 g may be the same as or similar to data sources 502 a, long-term/persistent database 502 g, and/or data sources 902 a. In some non-limiting embodiments, data sources 1002 g may be less expensive, longer-term, and/or lower performing data sources (e.g., Hadoop, legacy relational databases, Structured Query Language (SQL) databases, non-SQL (NoSQL) databases, and/or the like). In some non-limiting embodiments, data sources 1002 g may be devices (e.g. servers) of transaction service provider system 102. Additionally or alternatively, at least some data sources 1002 g may be devices (e.g., servers) of another system, another device, another group of systems, or another group of devices, separate from or including transaction service provider system 102, such as issuer system 104 (e.g., one or more devices of issuer system 104), customer device 106, merchant system 108 (e.g., one or more devices of merchant system 108), or acquirer system 110 (e.g., one or more devices of acquirer system 110).

In some non-limiting embodiments, scoring platform 1002 h may be the same as or similar to scoring platform 702 h. Additionally or alternatively, scoring platform 1002 h may be a scoring engine or any device/system having a scoring model, as described herein. For example, scoring platform 1002 h may be a part of transaction service provider system 102. Additionally or alternatively, scoring platform may be implemented (e.g., completely, partially, and/or the like) as part of issuer system 104, merchant system 108, and/or acquirer system 110. The scoring platform 1002 h may request one or more aggregations, the values of which may be inputs for variables in its scoring models, as described herein. Based on the risk score, the transaction may be approved (e.g., if the risk score is below a threshold) or denied (e.g., if the risk score is above a threshold).

For the purpose of illustration, scoring platform 1002 h may receive, from client device 1008, a request comprising aggregation of interest data associated with a type of aggregation of interest and set identification data associated with a set of data, as described herein. For example, client device 908 may communicate (e.g., transmit) the request based on user input to the scoring platform 1002 h. Additionally or alternatively, aggregator engine 1002 e may receive the request from the scoring platform and/or directly from the client device 1008, as described herein. Additionally or alternatively, aggregator engine 1002 e may determine the set of data is stored at a plurality of data sources (e.g. messaging cluster 1002 a, cache 1002 d, and/or data sources 1002 g), as described herein. For example, a subset of the set of data may be stored at each of messaging cluster 1002 a, cache 1002 d, and/or data sources 1002 g. Additionally or alternatively, aggregator engine 1002 e may instruct each data source (e.g., messaging cluster 1002 a, cache 1002 d, and/or data sources 1002 g) to determine at least one subset value associated with the type of aggregation of interest for the respective subset of the set of data stored thereon, as described herein. For example, each data source (e.g., messaging cluster 1002 a, cache 1002 d, and/or data sources 1002 g) may determine the subset value(s) associated with the type of aggregation of interest for the respective subset of the set of data stored thereon. For the purpose of illustration, the subset value(s) associated with the messaging cluster 1002 a may be determined based on a raw data index/keys in the cache 1002 d, as described herein. Additionally or alternatively, subset value(s) associated with data sources 1002 g may be determined at each data source 1002 g according to jobs scheduled by distributed scheduler 1002 f, as described herein, and such subset value(s) may be communicated to (and/or received by) the cache 1002 d, as described herein. Additionally or alternatively, aggregator engine 1002 e may receive the subset value(s) from each data source (e.g., messaging cluster 1002 a, cache 1002 d, and/or data sources 1002 g), as described herein. For example, each cache 1002 d may communicate (e.g., transmit) the subset value(s) to aggregator engine 1002 e. Additionally or alternatively, aggregator engine 1002 e may determine an aggregation value based on combining the at least one subset value from each data source (e.g., messaging cluster 1002 a, cache 1002 d, and/or data sources 1002 g), as described herein. Additionally or alternatively, aggregator engine 1002 e may communicate the aggregation value to client device 1008, as described herein. For example, client device 1008 may receive the aggregation value and/or present (e.g., display) the aggregation value to the user.

In some non-limiting embodiments, distributed scheduler 1002 f may instruct each data source 1002 g to determine the subset value(s) as part of a scheduled job at the respective data source 1002 g, as described herein.

In some non-limiting embodiments, the set of data may include payment transaction data associated with a plurality of payment transactions during one or more periods. Additionally or alternatively, the request may include second payment transaction data associated with a payment transaction. For example, the second transaction data may include a transaction amount of the payment transaction and/or an IP address associated with the payment transaction. Additionally or alternatively, the type of aggregation of interest may include different sets of aggregations based on context (e.g., context-based aggregations). For example, aggregator engine 1002 e may perform a set of aggregations if the transaction amount is above a threshold and a second set of aggregations if the transaction amount is below the threshold. Additionally or alternatively, aggregator engine 1002 e may perform a set of aggregations if the IP address is disreputable and a second set of aggregations if the IP address is reputable.

In some non-limiting embodiments, messaging cluster 1002 a may include (at least a portion of) the payment transaction data. Additionally or alternatively, ingestion service 1002 c may determine a key associated with each payment transaction of the plurality of payment transactions based on a portion of the payment transaction data associated with each payment transaction of the plurality of payment transactions and the aggregation of interest data. Additionally or alternatively, ingestion service 1002 c may store (e.g., in cache 1002 d, a raw data index of cache 1002 d, and/or one or more data sources 1002 g) a second portion of the payment transaction data associated with each payment transaction of the plurality of payment transactions in a map data structure based on the key of the respective payment transaction of the plurality of payment transaction, and the portion of the payment transaction data and the second portion of the payment transaction data may be different. In some non-limiting embodiments, ingestion service 1002 c, cache 1002 d, and/or data sources 1002 g may sort the keys associated with the plurality of payment transactions based on the aggregation of interest data. In some non-limiting embodiments, at least one data source (e.g., cache 1002 d and/or data sources 1002 g) may identify a plurality of the keys associated with the subset of the set of data stored on that respective data source. Additionally or alternatively, such data source may determine the subset value(s) for the subset of the set of data stored thereon based on the plurality of the keys.

In some non-limiting embodiments, the period(s) may include a first time period, a plurality of second time periods, and a plurality of third time periods. For example, a first data source (e.g., messaging cluster 1002 a, cache 1002 d, and/or a raw data index thereof) may determine at least one first subset value for a first subset of the set of data stored thereon, and that first subset may be associated with the first time period. Additionally or alternatively, a second data source (e.g., one or more of data sources 1002 g) may determine at least one second subset value for a second subset of the set of data stored thereon, and that second subset may be associated with the plurality of second time periods. Additionally or alternatively, a third data source (e.g., one or more of data sources 1002 g, which may be the same as or different from the second data source) may determine at least one third subset value for a third subset of the set of data stored thereon, and that third subset may be associated with the plurality of third time periods. In some non-limiting embodiments, the first time period may have a first duration, each of the plurality of second time periods may have a second duration, and each of the plurality of third time periods may have a third duration. Additionally or alternatively, the first duration may be less than the second duration, and the second duration may be less than the third duration. For example, the second duration may be an hour, the third duration may be a day, and the first duration may be a difference between a current time and an end of a previous hour.

Although the present disclosure has been described in detail for the purpose of illustration based on what is currently considered to be the most practical and preferred embodiments, it is to be understood that such detail is solely for that purpose and that the present disclosure is not limited to the disclosed embodiments, but, on the contrary, is intended to cover modifications and equivalent arrangements that are within the spirit and scope of the appended claims. For example, it is to be understood that the present disclosure contemplates that, to the extent possible, one or more features of any embodiment can be combined with one or more features of any other embodiment. 

What is claimed is:
 1. A method for aggregating data from a plurality of sources, comprising: receiving, with at least one processor from a user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with a first set of data; determining, with the at least one processor, the first set of data is stored at a plurality of servers, wherein a first subset of the first set of data is stored at each server of the plurality of servers; instructing, with the at least one processor, each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receiving, with the at least one processor, the at least one first subset value from each server; determining, with the at least one processor, a first aggregation value based on combining the at least one first subset value from each server; and communicating, with the at least one processor, the first aggregation value to the user client.
 2. The method of claim 1, wherein instructing each server to determine the at least one first subset value comprises instructing, by a distributed scheduler, each server to determine the at least one first subset value as part of a scheduled job at the respective server.
 3. The method of claim 1, wherein the first set of data comprises first payment transaction data associated with a first plurality of payment transactions during a period, and wherein the request comprises second payment transaction data associated with a payment transaction.
 4. The method of claim 3, wherein the second transaction data comprises a transaction amount of the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the transaction amount is above a threshold, and wherein the first type of aggregation of interest comprises a second set of aggregations if the transaction amount is below the threshold.
 5. The method of claim 3, wherein the second transaction data comprises an internet protocol (IP) address associated with the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the IP address is disreputable, and wherein the first type of aggregation of interest comprises a second set of aggregations if the IP address is reputable.
 6. The method of claim 3, further comprising: receiving, with the at least one processor, the first payment transaction data; determining, with the at least one processor, a first key associated with each payment transaction of the first plurality of payment transactions based on a first portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions and the first aggregation of interest data; and storing, with the at least one processor, a second portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions in a map data structure based on the first key of the respective payment transaction of the first plurality of payment transactions, wherein the first portion of the first payment transaction data and the second portion of the first payment transaction data are different.
 7. The method of claim 6, further comprising: sorting, with the at least one processor, the first keys associated with the first plurality of payment transactions based on the first aggregation of interest data.
 8. The method of claim 6, further comprising: identifying, by a first server of the plurality of servers, a first plurality of the first keys associated with the first subset of the first set of data stored on the first server; and determining, by the first server, the at least one first subset value for the first subset of the first set of data stored on the first server based on the first plurality of the first keys.
 9. The method of claim 3, wherein the period comprises a first time period, a plurality of second time periods, and a plurality of third time periods, the method further comprising: determining, by a first server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the first server, wherein the first subset of the first set of data stored on the first server is associated with the first time period; determining, by at least one second server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the at least one second server, wherein the first subset of the first set of data stored on the at least one second server is associated with the plurality of second time periods; and determining, by at least one third server of the plurality of servers, the at least one first subset value for the first subset of the first set of data stored on the at least one third server, wherein the first subset of the first set of data stored on the at least one third server is associated with the plurality of third time periods.
 10. The method of claim 9, wherein the first time period has a first duration, wherein each of the plurality of second time periods has a second duration, and each of the plurality of third time periods has a third duration, and further wherein the first duration is less than the second duration and the second duration is less than the third duration; and wherein the second duration is an hour, the third duration is a day, and the first duration is a difference between a current time and an end of a previous hour.
 11. A system for aggregating data from a plurality of sources, comprising: a user client; a plurality of servers storing a first set of data, wherein a first subset of the first set of data is stored at each server of the plurality of servers; and at least one processor, wherein the at least one processor is programmed or configured to: receive, from the user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with the first set of data; determine the first set of data is stored at the plurality of servers; instruct each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receive the at least one first subset value from each server; determine the first aggregation value based on combining the at least one first subset value from each server; and communicate the first aggregation value to the user client.
 12. The system of claim 11, further comprising a distributed scheduler, wherein instructing each server to determine the at least one first subset value comprises instructing the distributed scheduler to instruct each server to determine the at least one first subset value as part of a scheduled job at the respective server.
 13. The system of claim 11, wherein the first set of data comprises first payment transaction data associated with a first plurality of payment transactions during a period, and wherein the request comprises second payment transaction data associated with a payment transaction.
 14. The system of claim 13, wherein the second transaction data comprises a transaction amount of the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the transaction amount is above a threshold, and wherein the first type of aggregation of interest comprises a second set of aggregations if the transaction amount is below the threshold.
 15. The system of claim 13, wherein the second transaction data comprises an internet protocol (IP) address associated with the payment transaction, wherein the first type of aggregation of interest comprises a first set of aggregations if the IP address is disreputable, and wherein the first type of aggregation of interest comprises a second set of aggregations if the IP address is reputable.
 16. The system of claim 13, wherein the at least one processor is further programmed or configured to: receive the first payment transaction data; determine a first key associated with each payment transaction of the first plurality of payment transactions based on a first portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions and the first aggregation of interest data; and store a second portion of the first payment transaction data associated with each payment transaction of the first plurality of payment transactions in a map data structure based on the first key of the respective payment transaction of the first plurality of payment transactions, wherein the first portion of the first payment transaction data and the second portion of the first payment transaction data are different.
 17. The system of claim 16, wherein the at least one processor is further programmed or configured to: sort the first keys associated with the first plurality of payment transactions based on the first aggregation of interest data.
 18. The system of claim 16, wherein a first server of the plurality of servers is configured to: identify a first plurality of the first keys associated with the first subset of the first set of data stored on the first server; and determine the at least one first subset value for the first subset of the first set of data stored on the first server based on the first plurality of the first keys.
 19. The system of claim 13, wherein the period comprises a first time period, a plurality of second time periods, and a plurality of third time periods, wherein a first server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the first server, wherein the first subset of the first set of data stored on the first server is associated with the first time period; wherein at least one second server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the at least one second server, wherein the first subset of the first set of data stored on the at least one second server is associated with the plurality of second time periods; wherein at least one third server of the plurality of servers is configured to determine the at least one first subset value for the first subset of the first set of data stored on the at least one third server, wherein the first subset of the first set of data stored on the at least one third server is associated with the plurality of third time periods; wherein the first time period has a first duration, wherein each of the plurality of second time periods has a second duration, and each of the plurality of third time periods has a third duration, and further wherein the first duration is less than the second duration and the second duration is less than the third duration; and wherein the second duration is an hour, the third duration is a day, and the first duration is a difference between a current time and an end of a previous hour.
 20. A computer program product for aggregating data from a plurality of sources, the computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to: receive, from a user client, a first request comprising first aggregation of interest data associated with a first type of aggregation of interest and first set identification data associated with the first set of identification data; determine that the first set of data is stored at a plurality of servers; instruct each server to determine at least one first subset value associated with the first type of aggregation of interest for the respective first subset of the first set of data stored thereon; receive the at least one first subset value from each server; determine the first aggregation value based on combining the at least one first subset value from each server; and communicate the first aggregation value to the user client. 